Verified: all of the above holds. DefaultDataManager sets no size, so Elasticsearch applies its default of 10 hits, and git log -S searchInstalls confirms the single commit 7a8d0ea6e71 (14.4RC1) introduced the method without one. The three counting methods are indeed unaffected.
Two things worth adding:
No test could have caught it.PingSenderIT only ever indexes 2 pings, so the bound is never reached, and there is no unit test for DefaultDataManager at all.
There is no caller in xwiki-platform.ExtensionCode.UpdateInstalledExtensionCountScheduler calls services.activeinstalls — Active Installs 1, with a different 3-argument signature. The only possible callers are wiki pages on xwiki.org.
Of the two options listed, taking the second: keep the cap deliberately, and fix the javadoc and the reference page. Honouring the original javadoc is neither safe nor implementable:
It would be a DOS / OOM vector. A Ping embeds the whole extension list of the instance that sent it (hundreds of ExtensionPing entries) plus ten other sub-objects, and the index holds one ping per instance per day and per restart since 2022 — millions of documents. Buffering those into an ArrayList<Ping> exhausts the heap, and searchInstalls is reachable from any script holding script right.
Elasticsearch refuses it anyway: from + size may not exceed index.max_result_window (10000 by default). Unbounded retrieval would need a point-in-time plus a search_after loop.
Paging was considered and dropped. from/size paging over a live append-only index is not stable — pings arrive daily, so pages would silently duplicate and drop documents, trading this bug for a subtler one. Stable paging needs a PIT, which is a far larger API addition than any known caller justifies, especially now that XWIKI-24710's aggregation methods exist precisely so nobody has to retrieve pings in order to count them. If real paging is ever wanted, it deserves its own issue.
So the fix is documentation only, with no behaviour change, no @since addition, no release-note entry and no new test.
The reference page is already fixed: Active Installs Script Service — the searchInstalls row no longer claims to return the matching pings, and a new "Retrieving Pings" section states the bound, that there is no paging, and the reason for it.
This message was sent by Atlassian Jira (v9.3.0#930000-sha1:287aeb6)
If image attachments aren't displayed, see this article.
