Skip to content

Bump Solr 9x to latest opennlp 1.9.5#4555

Open
epugh wants to merge 3 commits into
apache:branch_9xfrom
epugh:increment_opennlp_version
Open

Bump Solr 9x to latest opennlp 1.9.5#4555
epugh wants to merge 3 commits into
apache:branch_9xfrom
epugh:increment_opennlp_version

Conversation

@epugh

@epugh epugh commented Jun 27, 2026

Copy link
Copy Markdown
Contributor

Description

Update to latest 1.9.x release of OpenNLP that fixes some CVE's.

Solution

Inspired by #1424, which removed pinning of opennlp to rely on Lucene's version, this undoes that and pins to 1.9.5 instead of the one that lucene relies on 1.9.4.

I will also open a PR against Lucene 9x in case there is ever a release of that to pick this up.

Tests

Re run existing tests.

@github-actions github-actions Bot added the dependencies Dependency upgrades label Jun 27, 2026
@epugh epugh changed the title bump to latest opennlp 1.9.5 Bump Solr 9x to latest opennlp 1.9.5 Jun 27, 2026
@epugh epugh requested a review from Copilot June 27, 2026 19:11

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR pins org.apache.opennlp:opennlp-tools to 1.9.5 on Solr 9.x (overriding the version otherwise inherited via Lucene) to pick up CVE fixes, and updates the dependency lock and license checksum metadata accordingly.

Changes:

  • Add an explicit opennlp-tools version override (1.9.5) in versions.props.
  • Update versions.lock to reflect the resolved opennlp-tools version.
  • Refresh license checksum files by adding the 1.9.5 SHA1 and removing the 1.9.4 SHA1.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File Description
versions.props Pins opennlp-tools to 1.9.5 via a version override.
versions.lock Updates the resolved/locked dependency version to 1.9.5.
solr/licenses/opennlp-tools-1.9.5.jar.sha1 Adds checksum metadata for the new opennlp-tools jar version.
solr/licenses/opennlp-tools-1.9.4.jar.sha1 Removes checksum metadata for the old opennlp-tools jar version.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread versions.props Outdated
@epugh

epugh commented Jun 27, 2026

Copy link
Copy Markdown
Contributor Author

Thanks @atarora for cutting the OpenNLP release, here is the bump to Solr 9...

@github-actions github-actions Bot added documentation Improvements or additions to documentation tool:build module:langid labels Jun 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependency upgrades documentation Improvements or additions to documentation module:langid tool:build

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants