Migrating a Production Django App from Elasticsearch to OpenSearch

The migration of a production Django application from Elasticsearch to OpenSearch due to a security vulnerability in the underlying transitive dependency, urllib3, became a complex undertaking. The legacy search client, elasticsearch==7.10.1, imposed a hard cap on urllib3 version 1.21.1, which prevented the application from receiving critical security patches for vulnerabilities like CVE-2025-50181.

The introduction of client-side checks in newer versions of elasticsearch-py that refused connections to non-Elasticsearch servers made the transition to OpenSearch challenging. Upgrading elasticsearch-py alone was not sufficient, as it was bound by the urllib3 constraint of 1.21.1, which was the lowest floor available. To address this issue, the team had to switch to opensearch-py, which is OpenSearch's own client and is compatible with both OpenSearch and the legacy Elasticsearch OSS endpoints.

However, selecting the appropriate version of opensearch-py was crucial, as earlier versions inherited the same urllib3 constraint, while recent versions like 2.8.0 provided support for urllib3 2.5.0 and beyond, thus addressing the security vulnerability. This migration story highlights the complexities involved in handling transitive dependencies and the need for careful version management when dealing with security patches in modern backend architectures.