This is an automated email from the ASF dual-hosted git repository.
epugh pushed a change to branch production
in repository https://gitbox.apache.org/repos/asf/solr-site.git
from 229786b84 Deploy to production
add c75f41bc1 Update VEX file with false positives
add 2b2c4ab9c Merge remote-tracking branch 'upstream/main' into Update-vex
add f84b24f5c Use the CycloneDX version, not OpenVex version
add c37e54cb7 Merge remote-tracking branch 'upstream/main' into Update-vex
add 64f0f83d6 Generate openvex from our cyclonedx inspired vex files.
add a463d3b25 List out each version of Solr that a VEX statement applies
to. Only works with lower bounded statements.
add d8b2ecc3f Openvex file being generated, though with hardcoded mappings.
add 481d358a5 Document how to use vex files with docker scout command.
add 358e841e9 as part of adding more netty cves, we added more of these
mappings. Ugh.
add 55d165804 Eliminate hardcoded JAR_GROUPS by using the current
generated file.
add 9fdcc3ad8 modules: solr-core or solr-solrj support. Omitting means
solr-core.
add 230171330 Demonstate using 'syft' tool to generate sbom that populates
the solr version mapping file.
add 56554beaf Merge remote-tracking branch 'upstream/main' into
add_openvex_support
add 194b79deb Merge remote-tracking branch 'upstream/main' into
add_openvex_support
add b22617ad0 Nicer variable name, be clear what we are doing.
add 2e3ba6c0b Reduces future error of omission by building in updating
this as part of regen fro solr 9 and later releases. Pre 9 is static.
add a49ddfda2 strip out the scanning of -slim version of solr, that
doesn't help us at all!
add cb01a37bf Document the vex steps.
add 6bb766605 Merge pull request #204 from epugh/add_openvex_support
add 9f1690dc5 Merge remote-tracking branch 'upstream/main' into Update-vex
add defafdc5a Convert older json content into our vex statement markdown.
Expanded versions to be accurate.
add 9e6d39f10 Filter out shaded code that doesn't actually ship. It
conflicts between our licenses listing and what syft finds and is a false
positive.
add d6ff765b3 Update dependencies napping for new jars.
add 91c0231e8 Merge pull request #173 from apache/Update-vex
add 0c1009882 Bump setuptools from 82.0.1 to 83.0.0
add 0e3a2b39e Merge pull request #208 from
apache/dependabot/pip/setuptools-83.0.0
add 368b19e0f Bump actions/checkout from 6.0.3 to 7.0.0
add 2e5508411 Merge pull request #197 from
apache/dependabot/github_actions/actions/checkout-7.0.0
add 7072ca61b Bump pip-tools from 7.5.3 to 7.6.0
add 9d1c5c5d8 Merge pull request #210 from
apache/dependabot/pip/pip-tools-7.6.0
add 8bffc69b1 Bump actions/checkout from 7.0.0 to 7.0.1
add a28d3b16b Merge pull request #209 from
apache/dependabot/github_actions/actions/checkout-7.0.1
add 9b0554c0c Bump python from `5a824eb` to `2673086`
add 809adea95 Merge pull request #198 from
apache/dependabot/docker/python-2673086
new 189841e3e Merge main into production: deploy to live site
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.github/workflows/build-pelican.yml | 2 +-
.github/workflows/pr-build-pelican.yml | 2 +-
Dockerfile | 2 +-
README.md | 46 +
build.sh | 22 +
content/pages/security-dependency-cves.md | 17 +-
content/solr/vex/2026-07-18-cve-2025-48734.md | 18 +
content/solr/vex/2026-07-18-cve-2026-33870.md | 22 +
content/solr/vex/2026-07-18-ghsa-72hv-8253-57qq.md | 18 +
plugins/vex/regenerate_dependency_mappings.py | 328 ++
plugins/vex/schema/openvex_json_schema.json | 317 ++
plugins/vex/schema/vex_article.schema.yaml | 9 +
plugins/vex/solr-dependency-versions.json | 3275 ++++++++++++++++++++
plugins/vex/solr-versions.txt | 128 +
plugins/vex/vex.py | 271 ++
requirements.in | 2 +-
requirements.txt | 12 +-
.../solr/templates/security-dependency-cves.html | 3 +-
18 files changed, 4482 insertions(+), 12 deletions(-)
create mode 100644 content/solr/vex/2026-07-18-cve-2025-48734.md
create mode 100644 content/solr/vex/2026-07-18-cve-2026-33870.md
create mode 100644 content/solr/vex/2026-07-18-ghsa-72hv-8253-57qq.md
create mode 100644 plugins/vex/regenerate_dependency_mappings.py
create mode 100644 plugins/vex/schema/openvex_json_schema.json
create mode 100644 plugins/vex/solr-dependency-versions.json
create mode 100644 plugins/vex/solr-versions.txt
