)]}' { "log": [ { "commit": "2e5508411721aefb851827a4cffac3df8d85eefd", "tree": "2bd8ee65abb375bd9c2a7552296d397bbb9f15fd", "parents": [ "0e3a2b39e7dd818dad02ef316ee045d63936afca", "368b19e0f53c9b16bb945020ebb026d25bb99df4" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Fri Jul 31 13:22:48 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 31 13:22:48 2026 -0400" }, "message": "Merge pull request #197 from apache/dependabot/github_actions/actions/checkout-7.0.0\n\nBump actions/checkout from 6.0.3 to 7.0.0" }, { "commit": "0e3a2b39e7dd818dad02ef316ee045d63936afca", "tree": "f91866cbe6a7c228e8ab602ca7a9678cec7eff4e", "parents": [ "91c0231e81bce63d9ade04bb9b0a98e4c5a6fed8", "0c1009882f56f1630b1c3d0ed949fc079bb8b79c" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Fri Jul 31 13:21:59 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 31 13:21:59 2026 -0400" }, "message": "Merge pull request #208 from apache/dependabot/pip/setuptools-83.0.0\n\nBump setuptools from 82.0.1 to 83.0.0" }, { "commit": "91c0231e81bce63d9ade04bb9b0a98e4c5a6fed8", "tree": "e8c83e576a3ab6002b82d9e67cd82f863e9dead9", "parents": [ "6bb7666051726e1588a69663d9a96333d354429d", "d6ff765b3fa1da9f598ac8490eb13ef63e2d1340" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Fri Jul 31 13:14:27 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 31 13:14:27 2026 -0400" }, "message": "Merge pull request #173 from apache/Update-vex\n\nUpdate VEX file with false positives" }, { "commit": "d6ff765b3fa1da9f598ac8490eb13ef63e2d1340", "tree": "e8c83e576a3ab6002b82d9e67cd82f863e9dead9", "parents": [ "9e6d39f10bdbb7a26107f6f563e95b73c07aa889" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Fri Jul 31 09:45:57 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Fri Jul 31 09:45:57 2026 -0400" }, "message": "Update dependencies napping for new jars.\n" }, { "commit": "9e6d39f10bdbb7a26107f6f563e95b73c07aa889", "tree": "3a81c32829c5c88ea9f37103a55977689196c700", "parents": [ "defafdc5ab229de3cdd67ffff0f49a711b605e9c" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Fri Jul 31 09:45:44 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Fri Jul 31 09:45:44 2026 -0400" }, "message": "Filter out shaded code that doesn\u0027t actually ship. It conflicts between our licenses listing and what syft finds and is a false positive.\n" }, { "commit": "defafdc5ab229de3cdd67ffff0f49a711b605e9c", "tree": "698933b74f359ecc0d32ae739aeea76afc6c0456", "parents": [ "9f1690dc5a925918063bbe069f5763c6a1f022be" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jul 30 12:35:16 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jul 30 12:35:16 2026 -0400" }, "message": "Convert older json content into our vex statement markdown. Expanded versions to be accurate.\n" }, { "commit": "9f1690dc5a925918063bbe069f5763c6a1f022be", "tree": "4f9604054db16311cdcae18f131da5e265306c53", "parents": [ "c37e54cb7cb5972e932127aca35dfc8898a2683c", "6bb7666051726e1588a69663d9a96333d354429d" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jul 30 11:50:37 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jul 30 11:50:37 2026 -0400" }, "message": "Merge remote-tracking branch \u0027upstream/main\u0027 into Update-vex\n" }, { "commit": "6bb7666051726e1588a69663d9a96333d354429d", "tree": "4f9604054db16311cdcae18f131da5e265306c53", "parents": [ "1752d809090cfd4a567f78e63c07714c3b8dd77e", "cb01a37bf67f46fa74809180a485d2cb72deefa6" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jul 30 11:48:48 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 30 11:48:48 2026 -0400" }, "message": "Merge pull request #204 from epugh/add_openvex_support\n\nAdd openvex format for our VEX statements." }, { "commit": "c37e54cb7cb5972e932127aca35dfc8898a2683c", "tree": "176658a2c38371c2604eac9aee500f6f9a113480", "parents": [ "f84b24f5c531c6cecdab0d70150e10faeddd7e22", "1752d809090cfd4a567f78e63c07714c3b8dd77e" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jul 30 11:44:26 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jul 30 11:44:26 2026 -0400" }, "message": "Merge remote-tracking branch \u0027upstream/main\u0027 into Update-vex\n" }, { "commit": "cb01a37bf67f46fa74809180a485d2cb72deefa6", "tree": "4f9604054db16311cdcae18f131da5e265306c53", "parents": [ "a49ddfda2dfcf77dbd770df479054b82ecfe6a83" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Tue Jul 28 20:06:07 2026 -0300" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Tue Jul 28 20:06:07 2026 -0300" }, "message": "Document the vex steps.\n" }, { "commit": "a49ddfda2dfcf77dbd770df479054b82ecfe6a83", "tree": "fd09d6a31150a11ea1f6db0f02ff061969fd3115", "parents": [ "2e3ba6c0bbf4790cfcacfadc7c51924f97ad7674" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Tue Jul 28 20:05:58 2026 -0300" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Tue Jul 28 20:05:58 2026 -0300" }, "message": "strip out the scanning of -slim version of solr, that doesn\u0027t help us at all!\n" }, { "commit": "2e3ba6c0bbf4790cfcacfadc7c51924f97ad7674", "tree": "50173247d1500c8b20f3c9fcef5ff518b364e834", "parents": [ "b22617ad01b0176b05b27d91244035bac0514e34" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Tue Jul 28 19:53:35 2026 -0300" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Tue Jul 28 19:53:35 2026 -0300" }, "message": "Reduces future error of omission by building in updating this as part of regen fro solr 9 and later releases. Pre 9 is static.\n" }, { "commit": "b22617ad01b0176b05b27d91244035bac0514e34", "tree": "26c2c21387943f7fce85fe384c1d945daa78cb5a", "parents": [ "194b79deb1faf4a82541265c4e5fca0f2a59f6aa" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Tue Jul 28 19:44:23 2026 -0300" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Tue Jul 28 19:44:23 2026 -0300" }, "message": "Nicer variable name, be clear what we are doing.\n" }, { "commit": "0c1009882f56f1630b1c3d0ed949fc079bb8b79c", "tree": "fb457d017c9e63ff07b5eb5395d0fe2fb5890170", "parents": [ "1752d809090cfd4a567f78e63c07714c3b8dd77e" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Jul 25 04:20:35 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Jul 25 04:20:35 2026 +0000" }, "message": "Bump setuptools from 82.0.1 to 83.0.0\n\nBumps [setuptools](https://github.com/pypa/setuptools) from 82.0.1 to 83.0.0.\n- [Release notes](https://github.com/pypa/setuptools/releases)\n- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)\n- [Commits](https://github.com/pypa/setuptools/compare/v82.0.1...v83.0.0)\n\n---\nupdated-dependencies:\n- dependency-name: setuptools\n dependency-version: 83.0.0\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "194b79deb1faf4a82541265c4e5fca0f2a59f6aa", "tree": "e39285cc7b2eddc570df96e5c52adba5bd8928cf", "parents": [ "56554beafc9f70c16fb0a44d74c2d7e44d1bbf7e", "1752d809090cfd4a567f78e63c07714c3b8dd77e" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Wed Jul 22 13:14:14 2026 -0300" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Wed Jul 22 13:14:14 2026 -0300" }, "message": "Merge remote-tracking branch \u0027upstream/main\u0027 into add_openvex_support\n" }, { "commit": "56554beafc9f70c16fb0a44d74c2d7e44d1bbf7e", "tree": "a5cc8a9de27303df05ba29539aec39fb204ecc52", "parents": [ "2301713308cdb8b731df809633dafbe357495424", "8257a48e37538810fecd4c2b7cb0e859a50811f0" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Wed Jul 22 12:30:20 2026 -0300" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Wed Jul 22 12:30:20 2026 -0300" }, "message": "Merge remote-tracking branch \u0027upstream/main\u0027 into add_openvex_support\n" }, { "commit": "1752d809090cfd4a567f78e63c07714c3b8dd77e", "tree": "176658a2c38371c2604eac9aee500f6f9a113480", "parents": [ "9180c4cfe8a27c7c65f53744aad5b54259a6c9ed", "6d315d94334fca0714d007f0dd5bb833e2560afd" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Wed Jul 22 11:29:42 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 22 11:29:42 2026 -0400" }, "message": "Merge pull request #205 from epugh/add_lower_bounds_to_versions\n\nRefine the VEX files to have specific jars and specific begin/end versions" }, { "commit": "9180c4cfe8a27c7c65f53744aad5b54259a6c9ed", "tree": "afb167023fc7b70c54f63aa9e239fe0cce62a2d7", "parents": [ "8257a48e37538810fecd4c2b7cb0e859a50811f0", "b636c0eb6ceb0416d2240df4e810ef5438b34628" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Wed Jul 22 11:29:14 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 22 11:29:14 2026 -0400" }, "message": "Merge pull request #206 from epugh/add_netty_cves\n\nDocument Netty CVE\u0027s impact on Solr" }, { "commit": "2301713308cdb8b731df809633dafbe357495424", "tree": "8035c3048aa3e09d5773af2503107c85bd3e44f4", "parents": [ "9fdcc3ad8b1bfe7573da40b96df324dcf45e7b7f" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Tue Jul 21 18:09:47 2026 -0300" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Tue Jul 21 18:09:47 2026 -0300" }, "message": "Demonstate using \u0027syft\u0027 tool to generate sbom that populates the solr version mapping file.\n" }, { "commit": "9fdcc3ad8b1bfe7573da40b96df324dcf45e7b7f", "tree": "b181016930943ef80e2ec6d87f01986af991c7ca", "parents": [ "55d1658043e32d0579dee0f63a61b5bd7e31b2af" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jul 19 18:33:41 2026 -0300" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jul 19 18:33:41 2026 -0300" }, "message": "modules: solr-core or solr-solrj support. Omitting means solr-core.\n" }, { "commit": "55d1658043e32d0579dee0f63a61b5bd7e31b2af", "tree": "a974a9d7b6565dd7ea399edb1830cc7f097be16f", "parents": [ "358e841e9477535e234f86cee114454294272335" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jul 19 18:20:49 2026 -0300" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jul 19 18:20:49 2026 -0300" }, "message": "Eliminate hardcoded JAR_GROUPS by using the current generated file.\n" }, { "commit": "b636c0eb6ceb0416d2240df4e810ef5438b34628", "tree": "3f03c61253b367d545387162e9762c2c9a36ec64", "parents": [ "511e2a7fb875179df0398c8d147b276dd1b18f10" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jul 19 11:01:01 2026 -0300" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jul 19 11:01:01 2026 -0300" }, "message": "Be more explicit about zk and ssl...\n" }, { "commit": "511e2a7fb875179df0398c8d147b276dd1b18f10", "tree": "f157f3dd3ab6aa13dfeff57a81ff504cd664d59d", "parents": [ "870c9e3d4b099e0971f412416a6671584608c87d" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jul 19 10:39:41 2026 -0300" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jul 19 10:39:41 2026 -0300" }, "message": "Provide more detailed history of netty in Solr, looking back at the netty-all uber jar.\n" }, { "commit": "358e841e9477535e234f86cee114454294272335", "tree": "6eb6165faf0e8afa58f3a07dea33171061dee8c9", "parents": [ "481d358a57700e27841f76cc9aef419acf0b80df" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sat Jul 18 10:09:39 2026 -0300" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sat Jul 18 10:09:39 2026 -0300" }, "message": "as part of adding more netty cves, we added more of these mappings. Ugh.\n" }, { "commit": "870c9e3d4b099e0971f412416a6671584608c87d", "tree": "e9f811705c3d04f4e45c623de0ae6b4496747378", "parents": [ "112478f84d872974f37c754a6d396d38c0963ab3" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sat Jul 18 09:56:38 2026 -0300" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sat Jul 18 09:56:38 2026 -0300" }, "message": "Document Netty CVE\u0027s impact on Solr\n" }, { "commit": "481d358a57700e27841f76cc9aef419acf0b80df", "tree": "b00bdb684120f8a63cc5b84d8c1a782eb3e0638c", "parents": [ "d8b2ecc3fbfd0068627f4d797c554e9499ba0cf1" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sat Jul 18 07:33:13 2026 -0300" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sat Jul 18 07:33:13 2026 -0300" }, "message": "Document how to use vex files with docker scout command.\n" }, { "commit": "d8b2ecc3fbfd0068627f4d797c554e9499ba0cf1", "tree": "b636b1509e304c444b5fa5db7db6ee7a064539c3", "parents": [ "a463d3b25801d0476fd31a0405052c759dc24415" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sat Jul 18 07:32:52 2026 -0300" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sat Jul 18 07:32:52 2026 -0300" }, "message": "Openvex file being generated, though with hardcoded mappings.\n" }, { "commit": "6d315d94334fca0714d007f0dd5bb833e2560afd", "tree": "ea4eeb6d1a088afcda18fb242394c60697db9285", "parents": [ "112478f84d872974f37c754a6d396d38c0963ab3" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Fri Jul 17 22:30:22 2026 -0300" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Fri Jul 17 22:30:22 2026 -0300" }, "message": "Refine the VEX files to have specific jars and specific begin/end versions.\n" }, { "commit": "8257a48e37538810fecd4c2b7cb0e859a50811f0", "tree": "751dcc3d1c478958c610b426ea5576ccd144e7cc", "parents": [ "823a7032c823277130b3979a937c49129f5969a3", "1d000461e9e9329b5fe78617cd95eeb135c90879" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Fri Jul 17 20:40:14 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 17 20:40:14 2026 -0400" }, "message": "Merge pull request #199 from apache/dependabot/pip/beautifulsoup4-4.15.0\n\nBump beautifulsoup4 from 4.14.3 to 4.15.0" }, { "commit": "823a7032c823277130b3979a937c49129f5969a3", "tree": "3ee23ceed4540f5fe3966c427b68020fb70866a3", "parents": [ "1369d330b1a794ed98b7f341a66c37d032c881b7", "dfb8968dd58ab860a761d1dc8fddcecaef4c7667" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Fri Jul 17 20:39:58 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 17 20:39:58 2026 -0400" }, "message": "Merge pull request #202 from apache/dependabot/pip/pip-26.1.2\n\nBump pip from 26.1 to 26.1.2" }, { "commit": "1369d330b1a794ed98b7f341a66c37d032c881b7", "tree": "40bd6f5eb45a21e7363af1caa1467c19c914ebce", "parents": [ "112478f84d872974f37c754a6d396d38c0963ab3", "5e06326f376fb8bf1612f35db8ce9b02b72e36e4" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Fri Jul 17 20:39:42 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 17 20:39:42 2026 -0400" }, "message": "Merge pull request #203 from apache/dependabot/pip/soupsieve-2.8.4\n\nBump soupsieve from 2.8.3 to 2.8.4" }, { "commit": "a463d3b25801d0476fd31a0405052c759dc24415", "tree": "cfdb8d25d6e50319f0b65e4dd4dabcab9db7c2eb", "parents": [ "64f0f83d603df0607a782a9ab96319f929bbd92e" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jul 16 10:48:47 2026 -0300" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jul 16 10:48:47 2026 -0300" }, "message": "List out each version of Solr that a VEX statement applies to. Only works with lower bounded statements.\n" }, { "commit": "64f0f83d603df0607a782a9ab96319f929bbd92e", "tree": "3f3a50e5c7045acace9de773bfdd83067991ebdf", "parents": [ "112478f84d872974f37c754a6d396d38c0963ab3" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jul 16 10:20:51 2026 -0300" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jul 16 10:20:51 2026 -0300" }, "message": "Generate openvex from our cyclonedx inspired vex files.\n" }, { "commit": "112478f84d872974f37c754a6d396d38c0963ab3", "tree": "4a378622abaf2a60e1f265af061aa97d7eb51513", "parents": [ "127ea7258a7aee162eb1072cdd0e816f8374e9c8", "d68c8626757828f5f1540b7312049aa5b221f14d" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Mon Jul 13 07:44:02 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 13 07:44:02 2026 -0400" }, "message": "Merge pull request #200 from epugh/cves_in_jetty_10\n\nVEX statements for CVEs affecting Jetty 10 in Solr 9" }, { "commit": "5e06326f376fb8bf1612f35db8ce9b02b72e36e4", "tree": "cedbbf9245dc66e236f60d8e4af0f41d31f34242", "parents": [ "127ea7258a7aee162eb1072cdd0e816f8374e9c8" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jul 10 21:19:12 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 10 21:19:12 2026 +0000" }, "message": "Bump soupsieve from 2.8.3 to 2.8.4\n\nBumps [soupsieve](https://github.com/facelessuser/soupsieve) from 2.8.3 to 2.8.4.\n- [Release notes](https://github.com/facelessuser/soupsieve/releases)\n- [Commits](https://github.com/facelessuser/soupsieve/compare/2.8.3...2.8.4)\n\n---\nupdated-dependencies:\n- dependency-name: soupsieve\n dependency-version: 2.8.4\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "dfb8968dd58ab860a761d1dc8fddcecaef4c7667", "tree": "ab505f9ca8ab4d585a48d3393a74c037c651361a", "parents": [ "127ea7258a7aee162eb1072cdd0e816f8374e9c8" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jul 10 20:31:17 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 10 20:31:17 2026 +0000" }, "message": "Bump pip from 26.1 to 26.1.2\n\nBumps [pip](https://github.com/pypa/pip) from 26.1 to 26.1.2.\n- [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst)\n- [Commits](https://github.com/pypa/pip/compare/26.1...26.1.2)\n\n---\nupdated-dependencies:\n- dependency-name: pip\n dependency-version: 26.1.2\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "d68c8626757828f5f1540b7312049aa5b221f14d", "tree": "4a378622abaf2a60e1f265af061aa97d7eb51513", "parents": [ "d4f175317229210ec34f13e9f8706d174a2c905e" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jul 02 12:47:46 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jul 02 12:47:46 2026 -0400" }, "message": "the way to mitifate this bug is at the proxy layer\n" }, { "commit": "d4f175317229210ec34f13e9f8706d174a2c905e", "tree": "89481011b19656f2786253fe3f0956701696a545", "parents": [ "08df1df8639b44080d110e9fbd7e31372044f566" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jul 02 12:31:42 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jul 02 12:31:42 2026 -0400" }, "message": "We require that vulnerabilties be exploitable against a secure Solr setup, and so this issue can be marked not exploitable when you have secure solr\n" }, { "commit": "08df1df8639b44080d110e9fbd7e31372044f566", "tree": "4beea2de8b8c8baace357b7bea160c35ebfa781e", "parents": [ "127ea7258a7aee162eb1072cdd0e816f8374e9c8" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jul 02 09:04:18 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jul 02 09:04:18 2026 -0400" }, "message": "VEX statements for CVEs affecting Jetty 10 in Solr 9\n" }, { "commit": "1d000461e9e9329b5fe78617cd95eeb135c90879", "tree": "7123e1120b3429afeba8fdedbc70e58eefb7050f", "parents": [ "127ea7258a7aee162eb1072cdd0e816f8374e9c8" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Jul 01 15:09:51 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 01 15:09:51 2026 +0000" }, "message": "Bump beautifulsoup4 from 4.14.3 to 4.15.0\n\nBumps [beautifulsoup4](https://www.crummy.com/software/BeautifulSoup/bs4/) from 4.14.3 to 4.15.0.\n\n---\nupdated-dependencies:\n- dependency-name: beautifulsoup4\n dependency-version: 4.15.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "368b19e0f53c9b16bb945020ebb026d25bb99df4", "tree": "e32b6a84eb2fbc8e4e9ade971f52e19d52ffcf6d", "parents": [ "127ea7258a7aee162eb1072cdd0e816f8374e9c8" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Jul 01 15:09:19 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 01 15:09:19 2026 +0000" }, "message": "Bump actions/checkout from 6.0.3 to 7.0.0\n\nBumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0)\n\n---\nupdated-dependencies:\n- dependency-name: actions/checkout\n dependency-version: 7.0.0\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "127ea7258a7aee162eb1072cdd0e816f8374e9c8", "tree": "541406569f7212bf726e95e4446d68a47b94a1b9", "parents": [ "289d27008d64482b65cc97075b17762e8b26bf46" ], "author": { "name": "Houston Putman", "email": "houston@apache.org", "time": "Mon Jun 22 10:03:33 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 22 10:03:33 2026 -0700" }, "message": "Add docs button to menus and fix operator docs links (#190)\n\n* Update Solr Operator doc links to the Reference Guide\n* Add sub-menus to cleanup bulk of nav menu items\n* Improve CSS for better navigability in the website\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e" }, { "commit": "289d27008d64482b65cc97075b17762e8b26bf46", "tree": "44cb1414058577f3eac77c897ed8dd7e9bb1a44b", "parents": [ "634dd7e04a1cdda36f0ac592a4e01fe364416a0f", "84841e7b11d949cba1f61cf75e9544b742651e83" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 15:03:34 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jun 21 15:03:34 2026 -0400" }, "message": "Merge pull request #196 from epugh/bump_cyclonedx_version_statement\n\nbumped the version of cyclone spec we are using" }, { "commit": "84841e7b11d949cba1f61cf75e9544b742651e83", "tree": "44cb1414058577f3eac77c897ed8dd7e9bb1a44b", "parents": [ "634dd7e04a1cdda36f0ac592a4e01fe364416a0f" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 15:03:03 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 15:03:03 2026 -0400" }, "message": "bumped the version we are using\n" }, { "commit": "634dd7e04a1cdda36f0ac592a4e01fe364416a0f", "tree": "eea3daf686b49a82ded1be18aeb2a52c347d8078", "parents": [ "282e8ad443e2d0f44be6a955fbca62e5a4a45e0e", "aa91d0f87a5883aea5741861f517f0a73f903e65" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 15:00:20 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jun 21 15:00:20 2026 -0400" }, "message": "Merge pull request #152 from ppkarwasz/fix/CVE-2025-48924_commons-lang\n\n[SOLR-17822] Document non-exploitability of CVE-2025-48924" }, { "commit": "aa91d0f87a5883aea5741861f517f0a73f903e65", "tree": "3ab8f2f9734d4c30bc398c9d4d0171d012e708db", "parents": [ "b5cc4981e56b5a4b406af98d09bbc040e4720cec" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 15:00:06 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 15:00:06 2026 -0400" }, "message": "Document commons lang vulnerablity\n" }, { "commit": "b5cc4981e56b5a4b406af98d09bbc040e4720cec", "tree": "aebb466011c5af65198490069a2e6c58718ed518", "parents": [ "ad34bfb0a57a0cb9c0f375bb82544f6b20fe53d3", "9c8e96141efa1f710878fab142ae4cf0ee3c057f" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 14:54:50 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 14:54:50 2026 -0400" }, "message": "Merge remote-tracking branch \u0027upstream/main\u0027 into pr/152\n" }, { "commit": "282e8ad443e2d0f44be6a955fbca62e5a4a45e0e", "tree": "4bb4468cb47fe8ae3869e9bf45c2b5a722bcbfaa", "parents": [ "2017b387755033d0d3aeabd4b0dc0d468104464d", "1843a369e2c7e6805043aebd299a93ee2b97d775" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 14:53:21 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jun 21 14:53:21 2026 -0400" }, "message": "Merge pull request #194 from apache/dependabot/pip/tornado-6.5.7\n\nBump tornado from 6.5.5 to 6.5.7" }, { "commit": "2017b387755033d0d3aeabd4b0dc0d468104464d", "tree": "16adcbc9eb384d83f2988f0310ab99beab0828c8", "parents": [ "705f8ddaaa6042992e0e3d300d520e65800dd45d", "f302bc6d989f263193b196dd156088523f043323" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 14:52:31 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jun 21 14:52:31 2026 -0400" }, "message": "Merge pull request #191 from epugh/vex-table-list-all\n\nList every VEX file on the CVE Dependencies along with their status" }, { "commit": "705f8ddaaa6042992e0e3d300d520e65800dd45d", "tree": "4975fd6096883f25056c2d2cf7f5925d9bfc5af8", "parents": [ "9c8e96141efa1f710878fab142ae4cf0ee3c057f", "30ae5da396cddd414c5c796dbd2a10603d090f8f" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 14:52:12 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jun 21 14:52:12 2026 -0400" }, "message": "Merge pull request #192 from epugh/add_opennlp_cve_as_vex\n\nadd OpenNLP CVE\u0027s Vex files" }, { "commit": "30ae5da396cddd414c5c796dbd2a10603d090f8f", "tree": "8e3f5bdf0e5b0b5e840121439a0015b6b7edac04", "parents": [ "8d3cf0f0e0e357f40573fb26089f31fdaba78a9a", "9b7cd51ceaf2cd0525bf76816ba3cf455569b639" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 14:51:43 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 14:51:43 2026 -0400" }, "message": "Merge branch \u0027add_opennlp_cve_as_vex\u0027 of github.com:epugh/solr-site into add_opennlp_cve_as_vex\n" }, { "commit": "8d3cf0f0e0e357f40573fb26089f31fdaba78a9a", "tree": "8e3f5bdf0e5b0b5e840121439a0015b6b7edac04", "parents": [ "477d81ba12cc434056cd3c8cbad40809a75a9a61" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 14:50:57 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 14:50:57 2026 -0400" }, "message": "provide more accurate state of play message, that will be updated again when integrated into solr\n" }, { "commit": "9b7cd51ceaf2cd0525bf76816ba3cf455569b639", "tree": "9076bdad601a1b27795b1b8fccd5aeaa78327133", "parents": [ "477d81ba12cc434056cd3c8cbad40809a75a9a61" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 14:47:43 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jun 21 14:47:43 2026 -0400" }, "message": "Potential fix for pull request finding\n\nCo-authored-by: Copilot Autofix powered by AI \u003c175728472+Copilot@users.noreply.github.com\u003e" }, { "commit": "9c8e96141efa1f710878fab142ae4cf0ee3c057f", "tree": "aad57cfe20ca601d5fadcbec8f56b7ada2128dca", "parents": [ "6c25d051631ebcdeb618e34a6302cea0c3e3a543", "0a709bbfe4f7179f5aa1911a4e9df1bbd7ce2c51" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 14:46:55 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jun 21 14:46:55 2026 -0400" }, "message": "Merge pull request #193 from epugh/update_vex_status\n\nUpdate VEX status files to where we are today, June 2026" }, { "commit": "0a709bbfe4f7179f5aa1911a4e9df1bbd7ce2c51", "tree": "4c2cbf2db91cc442606a5279e1d1037c65d0f86a", "parents": [ "aa45b06869ccae73d5bf2a142eee5d830d7cb0ef" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 14:45:58 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 14:45:58 2026 -0400" }, "message": "we dont need the jira issue\n" }, { "commit": "aa45b06869ccae73d5bf2a142eee5d830d7cb0ef", "tree": "957deee467df12241686e3098d0f558a07a36bbb", "parents": [ "19ffc4e6b454188e962a08e383882c2b8174fa44" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 14:42:25 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jun 21 14:42:25 2026 -0400" }, "message": "Potential fix for pull request finding\n\nCo-authored-by: Copilot Autofix powered by AI \u003c175728472+Copilot@users.noreply.github.com\u003e" }, { "commit": "6c25d051631ebcdeb618e34a6302cea0c3e3a543", "tree": "1ae19fa8fbd84a477ccf7f1a4706cfde1418d735", "parents": [ "41ff6facf47663c8f802f8b0a9c040c296ba5d08", "0e33e735a3b8542aa4253ed4d43d28cf9c917dbc" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sun Jun 21 14:42:04 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jun 21 14:42:04 2026 -0400" }, "message": "Merge pull request #195 from vex-generation-toolset/vex/log4j-april-2026\n\nSOLR-18288: VEX statements for the April 2026 Apache Log4j CVEs" }, { "commit": "f302bc6d989f263193b196dd156088523f043323", "tree": "5ff006095fe68e42f28e3cd31174d202bc9a05be", "parents": [ "6b82b6ee74ecf4b8bad3b3790abb63f445cd9fa9" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jun 18 08:43:43 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jun 18 08:43:43 2026 -0400" }, "message": "make sure to only show Vex entries for dependencies, not Solr itself, they go in the main security page\n" }, { "commit": "19ffc4e6b454188e962a08e383882c2b8174fa44", "tree": "01d128c92394c544f9cdbff43a6c25feb29c4067", "parents": [ "cb5409a43ba763289b83e1af69b3589b2b205db0" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jun 18 08:39:11 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Thu Jun 18 08:39:11 2026 -0400" }, "message": "refine the versions of Solr that vex entries apply to\n" }, { "commit": "0e33e735a3b8542aa4253ed4d43d28cf9c917dbc", "tree": "1ae19fa8fbd84a477ccf7f1a4706cfde1418d735", "parents": [ "a82ecbcd3a1128f7b23394a7dab4cc8bb40d9dd6" ], "author": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Thu Jun 18 08:08:13 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Thu Jun 18 08:08:13 2026 +0200" }, "message": "SOLR-18288: Link April 2026 Log4j VEX statements to JIRA issue\n\nAdd the jira: SOLR-18288 front-matter field to all five April 2026\nApache Log4j CVE VEX statements (CVE-2026-34477 through -34481).\n\nAssisted-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "a82ecbcd3a1128f7b23394a7dab4cc8bb40d9dd6", "tree": "2ffb8f8335b64228779062223b7716851240a19f", "parents": [ "f77e1eb55c1363b3c7945d4dcabfb6d86717d512" ], "author": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Thu Jun 18 08:04:00 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Thu Jun 18 08:04:00 2026 +0200" }, "message": "SOLR-18288: Fix MapMessage family description in CVE-2026-34481 VEX\n\nRemove ObjectMapMessage (a package-private test-only class, not shipped)\nfrom the listed MapMessage family, and drop the hardcoded JAR count so the\nstatement is accurate for both the 9.10.1 and 10.0.0 distributions.\n\nAssisted-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "f77e1eb55c1363b3c7945d4dcabfb6d86717d512", "tree": "bd0c6f45c4617b90889bb2d879d555bc4ebb5f9b", "parents": [ "10132d9866224795060cceaadb22188fd5611226" ], "author": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Thu Jun 18 07:57:02 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Thu Jun 18 07:57:02 2026 +0200" }, "message": "fix: extend statements to Solr `10.0.0`\n" }, { "commit": "10132d9866224795060cceaadb22188fd5611226", "tree": "872fdf5a1213528efcd40cb49c54134be1a721b6", "parents": [ "41ff6facf47663c8f802f8b0a9c040c296ba5d08" ], "author": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Wed Jun 17 21:44:43 2026 +0200" }, "committer": { "name": "Piotr P. Karwasz", "email": "pkarwasz-github@apache.org", "time": "Wed Jun 17 21:44:43 2026 +0200" }, "message": "SOLR-18288: VEX statements for the April 2026 Apache Log4j CVEs\n\nAssess the Solr 9.10.1 binary distribution against the five Log4j CVEs\npublished on 2026-04-10:\n\n* CVE-2026-34477 (log4j-core, TLS hostname verification)\n* CVE-2026-34478 (log4j-core, Rfc5424Layout CRLF injection)\n* CVE-2026-34479 (log4j-1.2-api, Log4j1XmlLayout malformed XML)\n* CVE-2026-34480 (log4j-core, XmlLayout malformed XML)\n* CVE-2026-34481 (log4j-layout-template-json, JsonTemplateLayout invalid JSON)\n\nAll are marked not_affected. CVE-2026-34477 through CVE-2026-34480 are\nrequires_configuration: Solr\u0027s shipped Log4j configs only use PatternLayout\non Console and RollingRandomAccessFile appenders, so the vulnerable layouts\nand network appenders are never instantiated. CVE-2026-34481 is\ncode_not_reachable: no code in the distribution ever logs a MapMessage, so\nthe vulnerable resolver can never receive a triggering value.\n\nAssisted-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "1843a369e2c7e6805043aebd299a93ee2b97d775", "tree": "3c8198cf3bb2cdb950dc0e6b72305c0e1a172f8e", "parents": [ "41ff6facf47663c8f802f8b0a9c040c296ba5d08" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Jun 17 18:04:10 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 17 18:04:10 2026 +0000" }, "message": "Bump tornado from 6.5.5 to 6.5.7\n\nBumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.5 to 6.5.7.\n- [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst)\n- [Commits](https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.7)\n\n---\nupdated-dependencies:\n- dependency-name: tornado\n dependency-version: 6.5.7\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "cb5409a43ba763289b83e1af69b3589b2b205db0", "tree": "5b3b72f7d058ee2e57c35b7dbe7c8a436e86e6de", "parents": [ "83d7bfa1aa21e1effe48236ac2e1092710a7d706" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Wed Jun 17 10:52:23 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Wed Jun 17 10:52:23 2026 -0400" }, "message": "refine why this jar trips up scanners\n" }, { "commit": "83d7bfa1aa21e1effe48236ac2e1092710a7d706", "tree": "3a5792fe0ce58563a92a8172e9d059bd2c4979cb", "parents": [ "b1e105daa4a5b5f37ab7925fe38c6e5802f87f3c" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Wed Jun 17 10:50:45 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Wed Jun 17 10:50:45 2026 -0400" }, "message": "this is too undefined, and really isnt a vex file\n" }, { "commit": "b1e105daa4a5b5f37ab7925fe38c6e5802f87f3c", "tree": "637e4d7ee982cf4e7f7acbdd9c188c463c5c5ae4", "parents": [ "43097c002ec563e87fedf9419639630452aa37e2" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Wed Jun 17 10:50:04 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Wed Jun 17 10:50:04 2026 -0400" }, "message": "align this rather generic issue to follow our vex pattern more closely\n" }, { "commit": "43097c002ec563e87fedf9419639630452aa37e2", "tree": "206e0325f4280adacd4f6ac011de8dea9958c26f", "parents": [ "41ff6facf47663c8f802f8b0a9c040c296ba5d08" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Wed Jun 17 10:23:50 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Wed Jun 17 10:23:50 2026 -0400" }, "message": "With AI support, update the open ended versions to being close ended.\n" }, { "commit": "477d81ba12cc434056cd3c8cbad40809a75a9a61", "tree": "85f2cf7d72c0b8cb56b5d1e0cddaf591eee4bbc8", "parents": [ "41ff6facf47663c8f802f8b0a9c040c296ba5d08" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Wed Jun 17 08:57:26 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Wed Jun 17 08:57:26 2026 -0400" }, "message": "add OpenNLP CVE Vex files\n" }, { "commit": "6b82b6ee74ecf4b8bad3b3790abb63f445cd9fa9", "tree": "db30f254a9fffff8ba5df2b80fa06e3fe1d8e9fa", "parents": [ "830f8c47f1ccf6fccf3231fe0a4efa1086fe4221" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Wed Jun 17 08:35:53 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Wed Jun 17 08:35:53 2026 -0400" }, "message": "we don\u0027t need the extra details...\n" }, { "commit": "830f8c47f1ccf6fccf3231fe0a4efa1086fe4221", "tree": "b21e8b7f632009595bc73e535929ffbe37738251", "parents": [ "41ff6facf47663c8f802f8b0a9c040c296ba5d08" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Wed Jun 17 08:24:28 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Wed Jun 17 08:24:28 2026 -0400" }, "message": "List all VEX entries in the CVE table with a status tag\n\nShow every VEX entry in security-dependency-cves.html regardless of\nanalysis.state or whether it names vulnerable JARs (previously only\nnon-exploitable, JAR-bearing entries were listed), and render\nanalysis.state as a colored cdx-* tag.\n\nCo-Authored-By: Claude Opus 4.8 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "41ff6facf47663c8f802f8b0a9c040c296ba5d08", "tree": "c39682eb0909c498fd6abcda581423fe7dbfd2b9", "parents": [ "1496751287ea8012aa847d0b635aea07dbb4d7de" ], "author": { "name": "Houston Putman", "email": "houston@apache.org", "time": "Fri Jun 12 11:40:24 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jun 12 11:40:24 2026 -0700" }, "message": "Make Solr Operator ref guide available (#188)" }, { "commit": "1496751287ea8012aa847d0b635aea07dbb4d7de", "tree": "039239b7896766a8765e849ba923437daa65467f", "parents": [ "c6f9c09623ac82a1d01e4184d287cd7c63c5f0ef", "007b73d18033834bf779141ab57100bce68efe0e" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Tue Jun 09 15:28:06 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 09 15:28:06 2026 -0400" }, "message": "Merge pull request #153 from ppkarwasz/feat/vex-plugin\n\nfeat: Revamp vulnerability page" }, { "commit": "007b73d18033834bf779141ab57100bce68efe0e", "tree": "039239b7896766a8765e849ba923437daa65467f", "parents": [ "e24dce46973c1bd7f9faeec8a363f80df8fc2019" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Tue Jun 09 12:59:30 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Tue Jun 09 12:59:30 2026 -0400" }, "message": "Simplify vex file\n" }, { "commit": "e24dce46973c1bd7f9faeec8a363f80df8fc2019", "tree": "a462090472433f1cd1a966680326a3a49b047907", "parents": [ "770def523167660d046782028f5ce99017abce0e" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Tue Jun 09 12:57:50 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Tue Jun 09 12:57:50 2026 -0400" }, "message": "We are now on 1.6 spec version\n" }, { "commit": "770def523167660d046782028f5ce99017abce0e", "tree": "be7e5760c6e2065a0c10f58c2f39d003d1ff1d00", "parents": [ "ce92d4a9487e5a66e7a7c983acc8e99250deb438" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Tue Jun 09 12:57:39 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Tue Jun 09 12:57:39 2026 -0400" }, "message": "Add similar ghsa linking as for cve\n" }, { "commit": "ce92d4a9487e5a66e7a7c983acc8e99250deb438", "tree": "73f512f2b68b1f4d5b56990e0e7bb86b41d2b2b1", "parents": [ "70a056cadd7dc5869218432b567346fff6fc385f" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Tue Jun 09 12:37:01 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Tue Jun 09 12:37:01 2026 -0400" }, "message": "Support GHSA and CVE links.\n" }, { "commit": "70a056cadd7dc5869218432b567346fff6fc385f", "tree": "67accfca9d7094a7ee3f0401e3e14a386d6181e2", "parents": [ "3ed5a6591709ce6355095123297e87d35b4bd880" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Tue Jun 09 12:08:55 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 09 12:08:55 2026 -0400" }, "message": "Potential fix for pull request finding\n\nCo-authored-by: Copilot Autofix powered by AI \u003c175728472+Copilot@users.noreply.github.com\u003e" }, { "commit": "3ed5a6591709ce6355095123297e87d35b4bd880", "tree": "9d385a85c23d913901f3730606a03023e0a3025d", "parents": [ "adaac50c01cfd068f4ef55cf834152752bcefd29" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Mon Jun 08 13:31:01 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Mon Jun 08 13:31:01 2026 -0400" }, "message": "Remove custom code.\n" }, { "commit": "adaac50c01cfd068f4ef55cf834152752bcefd29", "tree": "bdd2a523c1c992c8392992b57185cb7fd344d2a2", "parents": [ "1ff981b945b17b18b3407aca36e12652d29fba62" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sat Jun 06 12:21:18 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sat Jun 06 12:21:18 2026 -0400" }, "message": "Integrate validation of vex markdown files. Refactor link creation\n" }, { "commit": "1ff981b945b17b18b3407aca36e12652d29fba62", "tree": "40e604c9ec73f3b093420e049aa8ddb95cb220c3", "parents": [ "c9266ecc9436360d561bfb37bf040a98076ad658" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sat Jun 06 11:23:18 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sat Jun 06 11:23:18 2026 -0400" }, "message": "Rename vex files with date source from git history.\n" }, { "commit": "c9266ecc9436360d561bfb37bf040a98076ad658", "tree": "aca9d08961635dd2e8aa16e02a4fc453b82be01e", "parents": [ "2ef0f4cedc477054f356152e44c82797c5cdd158" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sat Jun 06 11:07:07 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sat Jun 06 11:07:07 2026 -0400" }, "message": "Link to detailed view of each vex from the security dependency table.\n" }, { "commit": "2ef0f4cedc477054f356152e44c82797c5cdd158", "tree": "625f6a0a19505049dedcb27b66db2d9887038cbe", "parents": [ "1f9ac553a30f07173e28e05bedb7ed671f86fdca" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sat Jun 06 10:23:26 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sat Jun 06 10:23:26 2026 -0400" }, "message": "Remove vulnerable_component/impacted_components metadata\n\nNiether of these attributes are directly mapped to either CycloneDX or OpenVEX schemas, and we only have data for three. Remove the concept to get this closer to something mergable.\n" }, { "commit": "1f9ac553a30f07173e28e05bedb7ed671f86fdca", "tree": "64df6bfc5ea5fec5537f7952213006b74559058c", "parents": [ "fc776f615b1a3f974d62f2fb0de4b77973eef1b5" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sat Jun 06 09:04:23 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Sat Jun 06 09:04:23 2026 -0400" }, "message": "Move to using .md files with front matter instead of JSON.\n\nEmbrace markdown files for storing data\nRemove severity attribute, it was only on three examples, and unclear how we assess that.\n" }, { "commit": "fc776f615b1a3f974d62f2fb0de4b77973eef1b5", "tree": "a07942a22bff9ff5f8885290ad910b0046f9d5ca", "parents": [ "e758c6ce6dbb9bf4ce9bfae06d67c1866cf75a05" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Fri Jun 05 16:48:44 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Fri Jun 05 16:48:44 2026 -0400" }, "message": "Now properly parsing the vex .md files frontmatter.\n" }, { "commit": "e758c6ce6dbb9bf4ce9bfae06d67c1866cf75a05", "tree": "fed003f10cf82ed6559eb5db0eb46e3c19fe3fdc", "parents": [ "1bafa144edeb0aedae9a6b50152fafb6831d00a4", "c6f9c09623ac82a1d01e4184d287cd7c63c5f0ef" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Fri Jun 05 16:33:53 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Fri Jun 05 16:33:53 2026 -0400" }, "message": "Merge remote-tracking branch \u0027upstream/main\u0027 into pr/153\n" }, { "commit": "f84b24f5c531c6cecdab0d70150e10faeddd7e22", "tree": "428ec3aade44b401dd540730838bf5808f4422f1", "parents": [ "2b2c4ab9c8deb9ed8de55ff4d176eab654f00e0c" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Fri Jun 05 16:21:17 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Fri Jun 05 16:21:17 2026 -0400" }, "message": "Use the CycloneDX version, not OpenVex version\n" }, { "commit": "2b2c4ab9c8deb9ed8de55ff4d176eab654f00e0c", "tree": "5da145b40b2a6923e84423c265f16aaaa2328d38", "parents": [ "c75f41bc1d45bf9704f3211cc22aaa33e47bb906", "c6f9c09623ac82a1d01e4184d287cd7c63c5f0ef" ], "author": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Fri Jun 05 16:12:28 2026 -0400" }, "committer": { "name": "Eric Pugh", "email": "epugh@opensourceconnections.com", "time": "Fri Jun 05 16:12:28 2026 -0400" }, "message": "Merge remote-tracking branch \u0027upstream/main\u0027 into Update-vex\n" }, { "commit": "c6f9c09623ac82a1d01e4184d287cd7c63c5f0ef", "tree": "89041fcc3e78fbe714af57146b96ff9a978289fd", "parents": [ "ee21c82417b976b3639488829bf092933903480c", "1127fcec53877eafba5adc2874cf681d18098d13" ], "author": { "name": "Jan Høydahl", "email": "janhoy@apache.org", "time": "Wed Jun 03 00:42:02 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 03 00:42:02 2026 +0200" }, "message": "Merge pull request #187 from apache/dependabot/github_actions/actions/checkout-6.0.3\n\nBump actions/checkout from 6.0.2 to 6.0.3" }, { "commit": "ee21c82417b976b3639488829bf092933903480c", "tree": "2fb84e0ef907919ed48f4835717909702c12c8ef", "parents": [ "23a2797a39aa39d94bd4c39ed3103fbb1d1a04d1", "35405f9ca49cb1474c0f07264b5f1d2b3f2b9bcb" ], "author": { "name": "Jan Høydahl", "email": "janhoy@apache.org", "time": "Wed Jun 03 00:41:45 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 03 00:41:45 2026 +0200" }, "message": "Merge pull request #186 from apache/dependabot/docker/python-5a824eb\n\nBump python from `dd4d2bd` to `5a824eb`" }, { "commit": "1127fcec53877eafba5adc2874cf681d18098d13", "tree": "f58700330ef6a9974b2f3836a742ce6deba7e56c", "parents": [ "23a2797a39aa39d94bd4c39ed3103fbb1d1a04d1" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Jun 02 21:11:17 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 02 21:11:17 2026 +0000" }, "message": "Bump actions/checkout from 6.0.2 to 6.0.3\n\nBumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10)\n\n---\nupdated-dependencies:\n- dependency-name: actions/checkout\n dependency-version: 6.0.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "35405f9ca49cb1474c0f07264b5f1d2b3f2b9bcb", "tree": "2fb84e0ef907919ed48f4835717909702c12c8ef", "parents": [ "23a2797a39aa39d94bd4c39ed3103fbb1d1a04d1" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Jun 02 21:10:38 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 02 21:10:38 2026 +0000" }, "message": "Bump python from `dd4d2bd` to `5a824eb`\n\nBumps python from `dd4d2bd` to `5a824eb`.\n\n---\nupdated-dependencies:\n- dependency-name: python\n dependency-version: 3.14-alpine\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "23a2797a39aa39d94bd4c39ed3103fbb1d1a04d1", "tree": "4e7a7c0c9dc7a4152e90c1f06a984b54eb3c8314", "parents": [ "19a6327032cddc50f7ed82423054c1554c4db815" ], "author": { "name": "parveensaini", "email": "parveen.saini2010@gmail.com", "time": "Sun May 24 14:03:03 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun May 24 17:03:03 2026 -0400" }, "message": "Add comparison harness link to Solr/Lucene migration post (#185)" }, { "commit": "19a6327032cddc50f7ed82423054c1554c4db815", "tree": "6573697d70ea1386a88091e850bbe2c6ce7891eb", "parents": [ "9cb57747f4b6b7712f69a690183a9aa63baf15ae", "87f6b914d961849862dfd97ddf970564a5959bfc" ], "author": { "name": "Jan Høydahl", "email": "janhoy@apache.org", "time": "Wed May 20 14:21:17 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed May 20 14:21:17 2026 +0200" }, "message": "Merge pull request #184 from apache/bump-pelican-workflows\n\nBump pelican version in workflows to 4.12.0" }, { "commit": "87f6b914d961849862dfd97ddf970564a5959bfc", "tree": "6573697d70ea1386a88091e850bbe2c6ce7891eb", "parents": [ "9cb57747f4b6b7712f69a690183a9aa63baf15ae" ], "author": { "name": "Jan Høydahl", "email": "jan.git@cominvent.com", "time": "Wed May 20 10:23:16 2026 +0200" }, "committer": { "name": "Jan Høydahl", "email": "jan.git@cominvent.com", "time": "Wed May 20 10:23:16 2026 +0200" }, "message": "Bump pelican version in workflows to 4.12.0\n" }, { "commit": "9cb57747f4b6b7712f69a690183a9aa63baf15ae", "tree": "03c059826aad84f9e50fa86036b31277acffafe6", "parents": [ "85eade45f7c82f41f39c872e38e4956cc8bcd8ed" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed May 20 10:07:31 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed May 20 10:07:31 2026 +0200" }, "message": "Bump idna from 3.11 to 3.15 (#182)\n\nBumps [idna](https://github.com/kjd/idna) from 3.11 to 3.15.\n- [Release notes](https://github.com/kjd/idna/releases)\n- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)\n- [Commits](https://github.com/kjd/idna/compare/v3.11...v3.15)\n\n---\nupdated-dependencies:\n- dependency-name: idna\n dependency-version: \u00273.15\u0027\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "85eade45f7c82f41f39c872e38e4956cc8bcd8ed", "tree": "0105d2b857d472c96afd4183007b95edef7f3c7f", "parents": [ "0c7186ce9f9c9c01697f4b13e52835706dbde41d" ], "author": { "name": "Jan Høydahl", "email": "jan.git@cominvent.com", "time": "Wed May 20 09:57:26 2026 +0200" }, "committer": { "name": "Jan Høydahl", "email": "jan.git@cominvent.com", "time": "Wed May 20 09:57:26 2026 +0200" }, "message": "Change sub header title from \"Recent CVE Disclosures for Apache Solr\" to \"Recent Security Advisories for Apache Solr\"\n" }, { "commit": "0c7186ce9f9c9c01697f4b13e52835706dbde41d", "tree": "6142a97016838f1ab644c4b49aba3c5f382b5a02", "parents": [ "055c91422f2154de126955baa45567f2f6b712b4" ], "author": { "name": "Jan Høydahl", "email": "janhoy@apache.org", "time": "Wed May 20 09:53:14 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed May 20 09:53:14 2026 +0200" }, "message": "Security advisory for jwt-auth blockunknown (#181)" }, { "commit": "055c91422f2154de126955baa45567f2f6b712b4", "tree": "0da4a246fde4e62ca3ee64ab2fce6bc53b168e77", "parents": [ "51c7b23123d99402d452b20ed067c892e456fd32" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed May 20 00:34:47 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed May 20 00:34:47 2026 +0200" }, "message": "Bump pelican from 4.11.0.post0 to 4.12.0 (#177)\n\nBumps [pelican](https://github.com/getpelican/pelican) from 4.11.0.post0 to 4.12.0.\n- [Release notes](https://github.com/getpelican/pelican/releases)\n- [Changelog](https://github.com/getpelican/pelican/blob/main/docs/changelog.rst)\n- [Commits](https://github.com/getpelican/pelican/commits/4.12.0)\n\n---\nupdated-dependencies:\n- dependency-name: pelican\n dependency-version: 4.12.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "51c7b23123d99402d452b20ed067c892e456fd32", "tree": "d3f537f9c9f1828a147393b5330bd912f490d134", "parents": [ "cfeeab4b78a58a82ca08da2e886a76e5fd58bf94" ], "author": { "name": "Jan Høydahl", "email": "janhoy@apache.org", "time": "Tue May 19 14:51:38 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue May 19 14:51:38 2026 +0200" }, "message": "Fix bloghome template broken by Pelican 4.12.0 (#180)" } ], "next": "cfeeab4b78a58a82ca08da2e886a76e5fd58bf94" }