This is an automated email from the ASF dual-hosted git repository.
epugh pushed a change to branch Update-vex
in repository https://gitbox.apache.org/repos/asf/solr-site.git
from f84b24f5c Use the CycloneDX version, not OpenVex version
add 15bccac04 feat: Support YAML front matter in Markdown files
add 473e5f4a9 feat: Add schema and parser for vulnerability metadata
add 1bafa144e feat: add Jinja2 template for vulnerability articles
add e758c6ce6 Merge remote-tracking branch 'upstream/main' into pr/153
add fc776f615 Now properly parsing the vex .md files frontmatter.
add 1f9ac553a Move to using .md files with front matter instead of JSON.
add 2ef0f4ced Remove vulnerable_component/impacted_components metadata
add c9266ecc9 Link to detailed view of each vex from the security
dependency table.
add 1ff981b94 Rename vex files with date source from git history.
add adaac50c0 Integrate validation of vex markdown files. Refactor link
creation
add 3ed5a6591 Remove custom code.
add 70a056cad Potential fix for pull request finding
add ce92d4a94 Support GHSA and CVE links.
add 770def523 Add similar ghsa linking as for cve
add e24dce469 We are now on 1.6 spec version
add 007b73d18 Simplify vex file
add 149675128 Merge pull request #153 from ppkarwasz/feat/vex-plugin
add 41ff6facf Make Solr Operator ref guide available (#188)
add 10132d986 SOLR-18288: VEX statements for the April 2026 Apache Log4j
CVEs
add f77e1eb55 fix: extend statements to Solr `10.0.0`
add a82ecbcd3 SOLR-18288: Fix MapMessage family description in
CVE-2026-34481 VEX
add 0e33e735a SOLR-18288: Link April 2026 Log4j VEX statements to JIRA
issue
add 6c25d0516 Merge pull request #195 from
vex-generation-toolset/vex/log4j-april-2026
add 43097c002 With AI support, update the open ended versions to being
close ended.
add b1e105daa align this rather generic issue to follow our vex pattern
more closely
add 83d7bfa1a this is too undefined, and really isnt a vex file
add cb5409a43 refine why this jar trips up scanners
add 19ffc4e6b refine the versions of Solr that vex entries apply to
add aa45b0686 Potential fix for pull request finding
add 0a709bbfe we dont need the jira issue
add 9c8e96141 Merge pull request #193 from epugh/update_vex_status
add 477d81ba1 add OpenNLP CVE Vex files
add 8d3cf0f0e provide more accurate state of play message, that will be
updated again when integrated into solr
add 9b7cd51ce Potential fix for pull request finding
add 30ae5da39 Merge branch 'add_opennlp_cve_as_vex' of
github.com:epugh/solr-site into add_opennlp_cve_as_vex
add 705f8ddaa Merge pull request #192 from epugh/add_opennlp_cve_as_vex
add 830f8c47f List all VEX entries in the CVE table with a status tag
add 6b82b6ee7 we don't need the extra details...
add f302bc6d9 make sure to only show Vex entries for dependencies, not
Solr itself, they go in the main security page
add 2017b3877 Merge pull request #191 from epugh/vex-table-list-all
add 1843a369e Bump tornado from 6.5.5 to 6.5.7
add 282e8ad44 Merge pull request #194 from
apache/dependabot/pip/tornado-6.5.7
add ad34bfb0a [SOLR-17822] Document non-exploitability of CVE-2025-48924
add b5cc4981e Merge remote-tracking branch 'upstream/main' into pr/152
add aa91d0f87 Document commons lang vulnerablity
add 634dd7e04 Merge pull request #152 from
ppkarwasz/fix/CVE-2025-48924_commons-lang
add 84841e7b1 bumped the version we are using
add 289d27008 Merge pull request #196 from
epugh/bump_cyclonedx_version_statement
add 127ea7258 Add docs button to menus and fix operator docs links (#190)
add 08df1df86 VEX statements for CVEs affecting Jetty 10 in Solr 9
add d4f175317 We require that vulnerabilties be exploitable against a
secure Solr setup, and so this issue can be marked not exploitable when you
have secure solr
add d68c86267 the way to mitifate this bug is at the proxy layer
add 112478f84 Merge pull request #200 from epugh/cves_in_jetty_10
add 5e06326f3 Bump soupsieve from 2.8.3 to 2.8.4
add 1369d330b Merge pull request #203 from
apache/dependabot/pip/soupsieve-2.8.4
add dfb8968dd Bump pip from 26.1 to 26.1.2
add 823a7032c Merge pull request #202 from apache/dependabot/pip/pip-26.1.2
add 1d000461e Bump beautifulsoup4 from 4.14.3 to 4.15.0
add 8257a48e3 Merge pull request #199 from
apache/dependabot/pip/beautifulsoup4-4.15.0
add 870c9e3d4 Document Netty CVE's impact on Solr
add 511e2a7fb Provide more detailed history of netty in Solr, looking back
at the netty-all uber jar.
add b636c0eb6 Be more explicit about zk and ssl...
add 9180c4cfe Merge pull request #206 from epugh/add_netty_cves
add 6d315d943 Refine the VEX files to have specific jars and specific
begin/end versions.
add 1752d8090 Merge pull request #205 from
epugh/add_lower_bounds_to_versions
add c37e54cb7 Merge remote-tracking branch 'upstream/main' into Update-vex
add 64f0f83d6 Generate openvex from our cyclonedx inspired vex files.
add a463d3b25 List out each version of Solr that a VEX statement applies
to. Only works with lower bounded statements.
add d8b2ecc3f Openvex file being generated, though with hardcoded mappings.
add 481d358a5 Document how to use vex files with docker scout command.
add 358e841e9 as part of adding more netty cves, we added more of these
mappings. Ugh.
add 55d165804 Eliminate hardcoded JAR_GROUPS by using the current
generated file.
add 9fdcc3ad8 modules: solr-core or solr-solrj support. Omitting means
solr-core.
add 230171330 Demonstate using 'syft' tool to generate sbom that populates
the solr version mapping file.
add 56554beaf Merge remote-tracking branch 'upstream/main' into
add_openvex_support
add 194b79deb Merge remote-tracking branch 'upstream/main' into
add_openvex_support
add b22617ad0 Nicer variable name, be clear what we are doing.
add 2e3ba6c0b Reduces future error of omission by building in updating
this as part of regen fro solr 9 and later releases. Pre 9 is static.
add a49ddfda2 strip out the scanning of -slim version of solr, that
doesn't help us at all!
add cb01a37bf Document the vex steps.
add 6bb766605 Merge pull request #204 from epugh/add_openvex_support
add 9f1690dc5 Merge remote-tracking branch 'upstream/main' into Update-vex
add defafdc5a Convert older json content into our vex statement markdown.
Expanded versions to be accurate.
No new revisions were added by this update.
Summary of changes:
README.md | 46 +
build.sh | 22 +
.../pages/operator/articles/explore-v030-gke.md | 24 +-
content/pages/operator/resources.md | 22 +-
content/pages/security-dependency-cves.md | 17 +-
content/pages/vex.md | 4 +
.../operator/news/2021-04-29-v0-3-0-available.md | 2 +-
.../operator/news/2021-09-13-v0-4-0-available.md | 2 +-
.../operator/news/2021-11-16-v0-5-0-available.md | 2 +-
.../operator/news/2022-03-21-v0-5-1-available.md | 2 +-
.../operator/news/2023-04-24-v0-7-0-available.md | 2 +-
.../operator/news/2023-07-21-v0-7-1-available.md | 2 +-
.../operator/news/2023-10-20-v0-8-0-available.md | 2 +-
.../operator/news/2024-04-12-v0-8-1-available.md | 2 +-
.../operator/news/2025-01-22-v0-9-0-available.md | 2 +-
.../operator/news/2025-03-25-v0-9-1-available.md | 2 +-
content/solr/vex/2022-12-14-cve-2012-0881.md | 12 +
content/solr/vex/2022-12-14-cve-2012-2098.md | 15 +
content/solr/vex/2022-12-14-cve-2014-0114.md | 12 +
content/solr/vex/2022-12-14-cve-2014-7940.md | 19 +
content/solr/vex/2022-12-14-cve-2015-5237.md | 12 +
content/solr/vex/2022-12-14-cve-2016-1181.md | 18 +
content/solr/vex/2022-12-14-cve-2016-6809.md | 18 +
content/solr/vex/2022-12-14-cve-2017-14868.md | 14 +
content/solr/vex/2022-12-14-cve-2017-14952.md | 13 +
content/solr/vex/2022-12-14-cve-2017-15095.md | 27 +
content/solr/vex/2022-12-14-cve-2017-15718.md | 13 +
content/solr/vex/2022-12-14-cve-2018-1000056.md | 12 +
content/solr/vex/2022-12-14-cve-2018-1000632.md | 12 +
.../solr/vex/2022-12-14-cve-2018-10237-guava.md | 12 +
content/solr/vex/2022-12-14-cve-2018-10237.md | 12 +
content/solr/vex/2022-12-14-cve-2018-1335.md | 12 +
content/solr/vex/2022-12-14-cve-2018-1471.md | 12 +
content/solr/vex/2022-12-14-cve-2018-8088.md | 14 +
content/solr/vex/2022-12-14-cve-2019-10086.md | 12 +
content/solr/vex/2022-12-14-cve-2019-10241.md | 14 +
content/solr/vex/2022-12-14-cve-2019-16869.md | 12 +
content/solr/vex/2022-12-14-cve-2020-13955.md | 13 +
content/solr/vex/2022-12-14-cve-2020-27218.md | 12 +
content/solr/vex/2022-12-14-cve-2020-27223.md | 12 +
content/solr/vex/2022-12-14-cve-2021-33813.md | 19 +
content/solr/vex/2022-12-14-cve-2021-44832.md | 13 +
content/solr/vex/2022-12-14-cve-2021-45105.md | 15 +
content/solr/vex/2022-12-14-cve-2022-25168.md | 18 +
content/solr/vex/2022-12-14-cve-2022-33980.md | 18 +
content/solr/vex/2022-12-14-cve-2022-39135.md | 14 +
content/solr/vex/2022-12-14-cve-2022-42889.md | 18 +
content/solr/vex/2024-01-12-cve-2023-51074.md | 18 +
content/solr/vex/2025-01-26-cve-2025-24814.md | 35 +
content/solr/vex/2025-02-26-cve-2024-6763.md | 19 +
content/solr/vex/2025-07-25-cve-2024-51504.md | 33 +
content/solr/vex/2025-08-02-cve-2024-7254.md | 20 +
content/solr/vex/2025-08-04-cve-2025-48924.md | 23 +
content/solr/vex/2026-04-10-cve-2026-34477.md | 44 +
content/solr/vex/2026-04-10-cve-2026-34478.md | 45 +
content/solr/vex/2026-04-10-cve-2026-34479.md | 42 +
content/solr/vex/2026-04-10-cve-2026-34480.md | 41 +
content/solr/vex/2026-04-10-cve-2026-34481.md | 27 +
content/solr/vex/2026-05-04-cve-2026-40682.md | 61 +
content/solr/vex/2026-05-04-cve-2026-42027.md | 70 +
content/solr/vex/2026-05-04-cve-2026-42440.md | 55 +
content/solr/vex/2026-06-18-cve-2025-11143.md | 50 +
content/solr/vex/2026-06-18-cve-2026-2332.md | 64 +
content/solr/vex/2026-06-18-cve-2026-5795.md | 36 +
content/solr/vex/2026-07-18-cve-2025-48734.md | 18 +
content/solr/vex/2026-07-18-cve-2026-33870.md | 22 +
content/solr/vex/2026-07-18-cve-2026-41417.md | 50 +
content/solr/vex/2026-07-18-cve-2026-42577.md | 69 +
content/solr/vex/2026-07-18-cve-2026-42578.md | 47 +
content/solr/vex/2026-07-18-cve-2026-42580.md | 51 +
content/solr/vex/2026-07-18-cve-2026-42581.md | 45 +
content/solr/vex/2026-07-18-cve-2026-42583.md | 43 +
content/solr/vex/2026-07-18-cve-2026-42584.md | 47 +
content/solr/vex/2026-07-18-cve-2026-42585.md | 41 +
content/solr/vex/2026-07-18-cve-2026-42587.md | 43 +
content/solr/vex/2026-07-18-cve-2026-44249.md | 48 +
content/solr/vex/2026-07-18-cve-2026-45416.md | 51 +
content/solr/vex/2026-07-18-cve-2026-45536.md | 52 +
content/solr/vex/2026-07-18-cve-2026-47244.md | 43 +
content/solr/vex/2026-07-18-cve-2026-47691.md | 25 +
content/solr/vex/2026-07-18-cve-2026-48043.md | 40 +
content/solr/vex/2026-07-18-cve-2026-50010.md | 54 +
content/solr/vex/2026-07-18-cve-2026-50020.md | 43 +
content/solr/vex/2026-07-18-cve-2026-50560.md | 40 +
content/solr/vex/2026-07-18-ghsa-72hv-8253-57qq.md | 18 +
pelicanconf.py | 8 +
plugins/vex/regenerate_dependency_mappings.py | 308 ++
plugins/vex/schema/bom-1.4.schema.json | 1697 ------
plugins/vex/schema/bom-1.6.schema.json | 5699 ++++++++++++++++++++
plugins/vex/schema/openvex_json_schema.json | 317 ++
plugins/vex/schema/vex-input.schema.json | 35 -
plugins/vex/schema/vex_article.schema.yaml | 51 +
plugins/vex/solr-dependency-versions.json | 3252 +++++++++++
plugins/vex/solr-versions.txt | 128 +
plugins/vex/tests/__init__.py | 1 +
plugins/vex/vex.py | 409 +-
requirements.in | 5 +-
requirements.txt | 135 +-
themes/solr/static/css/base.css | 165 +-
themes/solr/static/css/operator.css | 62 +-
themes/solr/static/javascript/main.js | 53 +-
themes/solr/templates/_footer.html | 2 +-
themes/solr/templates/_header.html | 27 +-
themes/solr/templates/htaccess.template | 2 +
themes/solr/templates/operator/_footer.html | 2 +-
themes/solr/templates/operator/_header.html | 3 +
themes/solr/templates/operator/features.html | 18 +-
.../solr/templates/security-dependency-cves.html | 18 +-
themes/solr/templates/vex.html | 82 +
vex-input.json | 563 --
110 files changed, 12745 insertions(+), 2474 deletions(-)
create mode 100644 content/pages/vex.md
create mode 100644 content/solr/vex/2022-12-14-cve-2012-0881.md
create mode 100644 content/solr/vex/2022-12-14-cve-2012-2098.md
create mode 100644 content/solr/vex/2022-12-14-cve-2014-0114.md
create mode 100644 content/solr/vex/2022-12-14-cve-2014-7940.md
create mode 100644 content/solr/vex/2022-12-14-cve-2015-5237.md
create mode 100644 content/solr/vex/2022-12-14-cve-2016-1181.md
create mode 100644 content/solr/vex/2022-12-14-cve-2016-6809.md
create mode 100644 content/solr/vex/2022-12-14-cve-2017-14868.md
create mode 100644 content/solr/vex/2022-12-14-cve-2017-14952.md
create mode 100644 content/solr/vex/2022-12-14-cve-2017-15095.md
create mode 100644 content/solr/vex/2022-12-14-cve-2017-15718.md
create mode 100644 content/solr/vex/2022-12-14-cve-2018-1000056.md
create mode 100644 content/solr/vex/2022-12-14-cve-2018-1000632.md
create mode 100644 content/solr/vex/2022-12-14-cve-2018-10237-guava.md
create mode 100644 content/solr/vex/2022-12-14-cve-2018-10237.md
create mode 100644 content/solr/vex/2022-12-14-cve-2018-1335.md
create mode 100644 content/solr/vex/2022-12-14-cve-2018-1471.md
create mode 100644 content/solr/vex/2022-12-14-cve-2018-8088.md
create mode 100644 content/solr/vex/2022-12-14-cve-2019-10086.md
create mode 100644 content/solr/vex/2022-12-14-cve-2019-10241.md
create mode 100644 content/solr/vex/2022-12-14-cve-2019-16869.md
create mode 100644 content/solr/vex/2022-12-14-cve-2020-13955.md
create mode 100644 content/solr/vex/2022-12-14-cve-2020-27218.md
create mode 100644 content/solr/vex/2022-12-14-cve-2020-27223.md
create mode 100644 content/solr/vex/2022-12-14-cve-2021-33813.md
create mode 100644 content/solr/vex/2022-12-14-cve-2021-44832.md
create mode 100644 content/solr/vex/2022-12-14-cve-2021-45105.md
create mode 100644 content/solr/vex/2022-12-14-cve-2022-25168.md
create mode 100644 content/solr/vex/2022-12-14-cve-2022-33980.md
create mode 100644 content/solr/vex/2022-12-14-cve-2022-39135.md
create mode 100644 content/solr/vex/2022-12-14-cve-2022-42889.md
create mode 100644 content/solr/vex/2024-01-12-cve-2023-51074.md
create mode 100644 content/solr/vex/2025-01-26-cve-2025-24814.md
create mode 100644 content/solr/vex/2025-02-26-cve-2024-6763.md
create mode 100644 content/solr/vex/2025-07-25-cve-2024-51504.md
create mode 100644 content/solr/vex/2025-08-02-cve-2024-7254.md
create mode 100644 content/solr/vex/2025-08-04-cve-2025-48924.md
create mode 100644 content/solr/vex/2026-04-10-cve-2026-34477.md
create mode 100644 content/solr/vex/2026-04-10-cve-2026-34478.md
create mode 100644 content/solr/vex/2026-04-10-cve-2026-34479.md
create mode 100644 content/solr/vex/2026-04-10-cve-2026-34480.md
create mode 100644 content/solr/vex/2026-04-10-cve-2026-34481.md
create mode 100644 content/solr/vex/2026-05-04-cve-2026-40682.md
create mode 100644 content/solr/vex/2026-05-04-cve-2026-42027.md
create mode 100644 content/solr/vex/2026-05-04-cve-2026-42440.md
create mode 100644 content/solr/vex/2026-06-18-cve-2025-11143.md
create mode 100644 content/solr/vex/2026-06-18-cve-2026-2332.md
create mode 100644 content/solr/vex/2026-06-18-cve-2026-5795.md
create mode 100644 content/solr/vex/2026-07-18-cve-2025-48734.md
create mode 100644 content/solr/vex/2026-07-18-cve-2026-33870.md
create mode 100644 content/solr/vex/2026-07-18-cve-2026-41417.md
create mode 100644 content/solr/vex/2026-07-18-cve-2026-42577.md
create mode 100644 content/solr/vex/2026-07-18-cve-2026-42578.md
create mode 100644 content/solr/vex/2026-07-18-cve-2026-42580.md
create mode 100644 content/solr/vex/2026-07-18-cve-2026-42581.md
create mode 100644 content/solr/vex/2026-07-18-cve-2026-42583.md
create mode 100644 content/solr/vex/2026-07-18-cve-2026-42584.md
create mode 100644 content/solr/vex/2026-07-18-cve-2026-42585.md
create mode 100644 content/solr/vex/2026-07-18-cve-2026-42587.md
create mode 100644 content/solr/vex/2026-07-18-cve-2026-44249.md
create mode 100644 content/solr/vex/2026-07-18-cve-2026-45416.md
create mode 100644 content/solr/vex/2026-07-18-cve-2026-45536.md
create mode 100644 content/solr/vex/2026-07-18-cve-2026-47244.md
create mode 100644 content/solr/vex/2026-07-18-cve-2026-47691.md
create mode 100644 content/solr/vex/2026-07-18-cve-2026-48043.md
create mode 100644 content/solr/vex/2026-07-18-cve-2026-50010.md
create mode 100644 content/solr/vex/2026-07-18-cve-2026-50020.md
create mode 100644 content/solr/vex/2026-07-18-cve-2026-50560.md
create mode 100644 content/solr/vex/2026-07-18-ghsa-72hv-8253-57qq.md
create mode 100644 plugins/vex/regenerate_dependency_mappings.py
delete mode 100644 plugins/vex/schema/bom-1.4.schema.json
create mode 100644 plugins/vex/schema/bom-1.6.schema.json
create mode 100644 plugins/vex/schema/openvex_json_schema.json
delete mode 100644 plugins/vex/schema/vex-input.schema.json
create mode 100644 plugins/vex/schema/vex_article.schema.yaml
create mode 100644 plugins/vex/solr-dependency-versions.json
create mode 100644 plugins/vex/solr-versions.txt
create mode 100644 plugins/vex/tests/__init__.py
create mode 100644 themes/solr/templates/vex.html
delete mode 100644 vex-input.json
