Test and move from Solr 8.X to Solr 9.X

[carlsonp]

Overview of the Feature Request

Solr 8.X, specifically, 8.11.2 according to this page: "is the last release in the 8.x series." This means it likely won't be receiving any more updates, features, or patches. This also may have implications from a security perspective. The Dataverse Solr schema and major changes should be reviewed and tested.

• Evaluate and update Solr schema if needed
• Smoke-test with Solr 9.X
• Update documentation
• Document migration steps?

What kind of user is the feature intended for?

Sysadmin and developers

What inspired the request?

What existing behavior do you want changed?

Any brand new behavior do you want to add to Dataverse?

Any related open or closed issues to this feature request?

[pdurbin]

@carlsonp hi! Thanks for pointing this out. As I said, Solr moves quickly! Again if you're interested in making a pull request, you might be able to follow the pattern of Solr upgrades in previous PRs:

• 47 upgrade solr 8 11 #8415
• 7373 solr upgrade #7645
• 6633 update solr 772 #6631

[pdurbin]

Not sizing this for now. Hoping we can help @carlsonp make a pull request. 😄 Please let us know!

Please note that this issue and PR are related:

• Solr 8.8 upgrade - remaining issues with solrconfig.xml #7662
• 7662 make solrconfig less static #8320

This might be somewhat easy to test by bumping the Solr version in dataverse-ansible (@donsizemore would know).

[carlsonp]

Migration away from Solr 8.X would help us in our intended deployment of Dataverse to Azure commercial. We're getting a lot of pushback on vulnerabilities both false-positives in the eyes of the Apache foundation as well as other vulnerabilities as CVEs. From scanning tools, they're picking up these CVEs and our Cybersecurity team wants them to be patched. We aren't interested in forking or patching upstream Solr so it seems Solr 9.X is a better longer-term solution. When I push and scan Solr 9.X there are less CVEs listed. This could be a major hold-up or full blocker in our ability to run Dataverse.

[pdurbin]

@carlsonp makes sense. Would you be able to email a list of Solr CVEs your tool is picking for Solr 8.11.1 (the version we use currently) to security@dataverse.org?

[mreekie]

Grooming:

• Including as part of Payara 6 upgrade deliverable

[donsizemore]

@pdurbin I just heard from our security group about my brand-new private Dataverse instances. Per Solr's security page https://solr.apache.org/security.html we're not realistically vulnerable to the CVEs in question, but I opened https://github.com/IQSS/dataverse-security/issues/79 in response to the newer CVE.

[carlsonp]

@carlsonp makes sense. Would you be able to email a list of Solr CVEs your tool is picking for Solr 8.11.1 (the version we use currently) to security@dataverse.org?

This is complete.

[cmbz]

• Prioritizing Payara 6 release
• Sizing needed