We are getting there! A few days ago on git push I would see the message:
GitHub found 39 vulnerabilities on apache/solr's default branch (3 critical, 14 high, 17 moderate, 5 low). To find out more, visit: remote: https://github.com/apache/solr/security/dependabot Today after merging some more updates I see: GitHub found 7 vulnerabilities on apache/solr's default branch (3 high, 4 moderate). I believe this is mostly by moving S3Mock v5 from v4, which embraces test containers for the S3 repo tests, which removed a bunch of dependencies like tomcat…. Main still seems to have failing test, but 10x and 9x seem good. > On Aug 23, 2026, at 6:06 AM, Eric Pugh <[email protected]> > wrote: > > These two builds are working fine: > > https://ci-builds.apache.org/job/Solr/job/Solr-Test-9.x/ > https://ci-builds.apache.org/job/Solr/job/Solr-Test-10.x/ > > However, https://ci-builds.apache.org/job/Solr/job/Solr-Test-main/ seems to > have a test that fails more often than not…. > > > > >> On Aug 22, 2026, at 1:43 PM, Eric Pugh <[email protected]> >> wrote: >> >> Hey all, >> >> I worked through the long list of “solrbot” authored PR’s >> (https://github.com/apache/solr/pulls/solrbot) and applied a bunch, to both >> main/branch_10x and some to branch_9x. >> >> There was definitely some fighting with lock files, so I’m hoping I’ve >> handled them all appropriately, and haven’t interfered with some other >> efforts to manage these better. >> >> In chatting with Jan, we talked about disabling the built in Github >> “dependabot” that was opening PR’s for upgrades as security alerts are >> found. This was leading to quite a few duplicate PRs with PR’s opened by >> “solrbot”. https://github.com/apache/solr/pull/4798 >> >> This way we will just have a monthly batch of upgrades for branch_9x and >> main. I’m hoping to finish next week getting the backlog of upgrade pre >> generated by "dependably" and “solrbot" cleared up. >> >> Eric >> > Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast, a leader in email security and cyber resilience. Mimecast integrates email defenses with brand protection, security awareness training, web security, compliance and other essential capabilities. Mimecast helps protect large and small organizations from malicious activity, human error and technology failure; and to lead the movement toward building a more resilient world. To find out more, visit our website.
