You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@solr.apache.org by ab...@apache.org on 2026/10/22 08:37:51 UTC
(solr) 04/04: Regenerate CHANGELOG.md for v10.1.0 RC3
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch branch_10_1
in repository https://gitbox.apache.org/repos/asf/solr.git
commit 749712b71940c9f96d824c533f32f5c56dcd3924
Author: Andrzej Białecki <ab...@apache.org>
AuthorDate: Thu Oct 22 10:37:40 2026 +0200
Regenerate CHANGELOG.md for v10.1.0 RC3
---
CHANGELOG.md | 86 +++++++-----------------------------
changelog/v10.1.0/version-summary.md | 84 +++++++----------------------------
2 files changed, 33 insertions(+), 137 deletions(-)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index efa78e3262d..c336bc529a5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,12 +13,6 @@ This file lists Solr's raw release notes with details of every change to Solr. M
[10.1.0]
--------
-### Important notes
-
-- Per-core `/solr/{core}/replication` commands are authorized individually. `backup`, `restore`, `deletebackup`, `disablereplication`, `enablereplication`, `abortfetch`, `disablepoll`, `enablepoll`, and `fetchindex` require the `update` permission; `indexversion`, `filelist`, `filecontent`, `details`, `commits`, and `restorestatus` require `read`. A command not listed here requires `update`. Grant `update` (or `all`) to roles that invoke the state-changing commands.
-- A `filecontent` request to `/solr/{core}/replication` with `dirType=cf` or `dirType=tlogFile` must name a file that resolves inside the core's config or tlog directory; otherwise it is rejected.
-- In SolrCloud, a request served by a core on the receiving node is authorized against that core's collection, regardless of the `collection` request parameter. Requests the core sends on to other collections, such as a distributed search over several collections or an alias, are authorized by the nodes that receive them, against their own collections. For example, a search sent to a core of collection `A` with `collection=B` needs read permission on both `A` and `B`.
-
### Added (65 changes)
- New SolrJ CollectionScopedSolrClient [PR#4418](https://github.com/apache/solr/pull/4418) (David Smiley)
@@ -116,11 +110,11 @@ This file lists Solr's raw release notes with details of every change to Solr. M
- Increased query throughput by removing a call to ZooKeeper for cluster state that should have been cached. Happens when Solr does distributed search over multiple collections, and when the coordinator has no local replica for some of them. [SOLR-18176](https://issues.apache.org/jira/browse/SOLR-18176) [SOLR-15352](https://issues.apache.org/jira/browse/SOLR-15352) (Matthew Biscocho)
- Move cluster concepts into Getting Started in Ref Guide [SOLR-18179](https://issues.apache.org/jira/browse/SOLR-18179) (Eric Pugh)
- JWT Authentication `blockUnknown` now defaults to `true`, blocking unauthenticated requests by default. Previously the code defaulted to `false` despite the reference guide documenting `true`. Users relying on pass-through must explicitly set `blockUnknown` to `false` in their security.json. [SOLR-18215](https://issues.apache.org/jira/browse/SOLR-18215) ([Jan Høydahl](https://home.apache.org/phonebook.html?uid=janhoy))
-- New solr.xml setting allowZkHosts limits which ZooKeeper connection strings a cross-collection join or streaming expression may use (zkHost or solrConnection); an HTTP(s) solrConnection must be a live node or be listed in allowUrls. The local SolrCloud ensemble is always allowed. zkHost and solrUrl are now mutually exclusive in a single cross-collection join clause. The local ensemble is matched verbatim, including any chroot: a node started with `-DzkHost=zk1:2181/solr` allows `zkHost [...]
-- The per-core /solr/{core}/replication endpoint is now authorized per command: state-changing commands require the "update" permission, while read-only commands continue to require "read". [SOLR-18225](https://issues.apache.org/jira/browse/SOLR-18225) (Mark Robert Miller)
-- Replication file fetching treats both "/" and "\" as path separators when validating a file name, and config/tlog file names must resolve within the core's config or tlog directory. [SOLR-18226](https://issues.apache.org/jira/browse/SOLR-18226) (Mark Robert Miller)
-- /update/extract (ExtractingRequestHandler) now requires the "update" permission rather than "read", since it indexes documents. [SOLR-18228](https://issues.apache.org/jira/browse/SOLR-18228) (Mark Robert Miller)
-- In SolrCloud, requests are authorized against the collection of the core that serves them; the "collection" request parameter is not used for authorization. [SOLR-18230](https://issues.apache.org/jira/browse/SOLR-18230) (David Smiley) (Mark Robert Miller)
+- New solr.xml setting allowZkHosts restricts the ZooKeeper hosts that cross-collection joins and streaming expressions may connect to. [SOLR-18224](https://issues.apache.org/jira/browse/SOLR-18224) [SOLR-18229](https://issues.apache.org/jira/browse/SOLR-18229) (Mark Robert Miller)
+- Replication endpoint authorization is now applied per command. [SOLR-18225](https://issues.apache.org/jira/browse/SOLR-18225) (Mark Robert Miller)
+- Replication file name validation has been tightened. [SOLR-18226](https://issues.apache.org/jira/browse/SOLR-18226) (Mark Robert Miller)
+- The /update/extract handler now requires the update permission. [SOLR-18228](https://issues.apache.org/jira/browse/SOLR-18228) (Mark Robert Miller)
+- Request authorization in SolrCloud now uses the collection of the core serving the request. [SOLR-18230](https://issues.apache.org/jira/browse/SOLR-18230) (David Smiley) (Mark Robert Miller)
- Migration of CancelTask V2 API to JAX-RS construct [SOLR-18248](https://issues.apache.org/jira/browse/SOLR-18248) (Jalaz Kumar) (Eric Pugh)
- Refactor Tasks API to use Nested Interfaces [SOLR-18248](https://issues.apache.org/jira/browse/SOLR-18248) (Jalaz Kumar)
- Restore -c option as a no-op to bin/solr start script to simplify scripts that interact with both Solr 10 and previous versions of Solr. [SOLR-18269](https://issues.apache.org/jira/browse/SOLR-18269) (Eric Pugh)
@@ -146,7 +140,7 @@ Diagnostic logging now reports empty and skipped columns. [SOLR-18508](https://i
- SolrJ v1 admin requests now use appropriate HTTP verbs -- mostly POST, some GET [SOLR-18343](https://issues.apache.org/jira/browse/SOLR-18343) (Xinyao Zhang)
- CrossDC Common optimize serialization for large docs [SOLR-18415](https://issues.apache.org/jira/browse/SOLR-18415) (Andrzej Bialecki)
-### Fixed (95 changes)
+### Fixed (99 changes)
- Fix getFirstLiveDoc so it returns the first live doc. Previously it would often return nothing resulting in missing index flags in /admin/luke response. [SOLR-18125](https://issues.apache.org/jira/browse/SOLR-18125) (Luke Kot-Zaniewski)
- using window.location.origin rather than hard coded URL [PR#4281](https://github.com/apache/solr/pull/4281) (Renato Haeberli)
@@ -197,8 +191,8 @@ Diagnostic logging now reports empty and skipped columns. [SOLR-18508](https://i
- Solr Admin UI properly supports multiple facet.field parameters [SOLR-18246](https://issues.apache.org/jira/browse/SOLR-18246) (Umut Saribiyik)
- CertAuthPlugin now uses correct Jetty attribute for certificate lookup for SSL authentication [SOLR-18270](https://issues.apache.org/jira/browse/SOLR-18270) (Jean-Marie HEITZ @heitzjm)
- Restore the parent shard to ACTIVE after a failed split even if cluster state is stale. [SOLR-18277](https://issues.apache.org/jira/browse/SOLR-18277) (Nick Shanin)
-- LoadAverageCircuitBreaker now caches its sampled value for a short TTL, so it stops re-polling the OS load average per request at high RPS. [SOLR-18284](https://issues.apache.org/jira/browse/SOLR-18284) (Mark Robert Miller)
-- MemoryCircuitBreaker now measures post-GC live heap data, so it no longer trips when the heap is full of collectible garbage. Earlier versions sampled MemoryMXBean.getHeapMemoryUsage().getUsed() on a 30-second moving average (6 samples), which trends toward max between collections during normal operation; if you tuned a threshold against that behavior you may need to revisit it. This breaks subclasses of MemoryCircuitBreaker: the deprecated MemoryCircuitBreaker(int, int) constructor is [...]
+- LoadAverageCircuitBreaker now caches its sampled load average instead of re-polling it on every request. [SOLR-18284](https://issues.apache.org/jira/browse/SOLR-18284) (Mark Robert Miller)
+- MemoryCircuitBreaker now measures post-GC live heap data, so it no longer trips on collectible garbage. [SOLR-18284](https://issues.apache.org/jira/browse/SOLR-18284) (Mark Robert Miller)
- ZkController no longer treats every ZooKeeper reconnect as session expiration. Re-election and core re-registration now run only after Curator reports ConnectionState.LOST, restoring Solr 9 behavior during ZK rolling restarts. [SOLR-18298](https://issues.apache.org/jira/browse/SOLR-18298) ([Shrey Narayan (NextBrick)](https://nextbrick.com))
- Incremental backup failures now report the original error instead of an unrelated missing zk_backup directory exception [SOLR-18303](https://issues.apache.org/jira/browse/SOLR-18303) (Prithvi S)
- Fix Thread Pool Starvation in HttpJdkSolrClient. HttpJdkSolrClient defaults would often create 32 threads, likely under-utilizing them. and it would cap threads to 256. Now it does neither by default but Executor customization (and other saturation controls) remain. [SOLR-18312](https://issues.apache.org/jira/browse/SOLR-18312) (Renato Haeberli) (David Smiley)
@@ -207,12 +201,14 @@ Diagnostic logging now reports empty and skipped columns. [SOLR-18508](https://i
- PRS based collection creation returns too early; can cause restore failure. [SOLR-18334](https://issues.apache.org/jira/browse/SOLR-18334) (David Smiley)
- /replication?command=details now reports backup details while the backup is still running, including file counts, instead of the previous backup's status [SOLR-18344](https://issues.apache.org/jira/browse/SOLR-18344) (Idan Tepper @idantepper)
- SolrJ ClientUtils.encodeLocalParamVal() can produce lossy/invalid encodings with a backslash or leading quotes. Affects faceting with a custom facet response key. Affects the SQL module for LIKE queries. [SOLR-18345](https://issues.apache.org/jira/browse/SOLR-18345) (David Smiley)
+- The metrics endpoints now answer HTTP 510 when metrics collection is disabled in solr.xml, on both the v1 and v2 API. The v1 API used to return HTTP 500, which made the Admin UI Plugins / Stats screen render blank. It now explains that metrics are disabled. [SOLR-18400](https://issues.apache.org/jira/browse/SOLR-18400) (Jan Høydahl) (Eric Pugh)
- Fix Solr emitting duplicate/conflicting JVM metrics from both runtime-telemetry-java8 and runtime-telemetry-java17 OTel scopes on Java 17, by migrating to the unified opentelemetry-runtime-telemetry module (upgraded to 2.31.1-alpha) that replaced the java8/java17 split. Also updating otel itself to 1.65.0 as well. [SOLR-18407](https://issues.apache.org/jira/browse/SOLR-18407) (Eric Pugh)
- CrossDC - ZooKeeper /crossdc.properties no longer overrides solr.crossdc.kafka.* sysprops or env vars [SOLR-18412](https://issues.apache.org/jira/browse/SOLR-18412) (Andrzej Bialecki @ab)
- Fix complement() and intersect() streaming expressions silently returning wrong results when on= maps two differently-named fields [SOLR-18418](https://issues.apache.org/jira/browse/SOLR-18418) ([David Smiley](https://home.apache.org/phonebook.html?uid=dsmiley))
- Fix a memory leak where every SolrIndexSearcher ever opened was retained by the OpenTelemetry metric registry via its "index.commit_size" observable gauge, along with its DirectoryReader and segment live-docs bitsets. Nodes with a high commit cadence would eventually run out of heap. Observable metrics registered through SolrMetricsContext with an explicit unit are now closed together with the context. [SOLR-18442](https://issues.apache.org/jira/browse/SOLR-18442) (Jan Høydahl) (Mikhai [...]
- `<metrics enabled="false"/>` in `solr.xml` now actually disables the metrics facility: no metric exporter or JVM runtime metrics are set up, and instruments are created from a no-op OpenTelemetry meter, so registries no longer accumulate metrics (and the memory they retain) for a disabled node. [SOLR-18455](https://issues.apache.org/jira/browse/SOLR-18455) ([Mikhail Khludnev](https://home.apache.org/phonebook.html?uid=mkhl) @mkhludnev)
- The OpenAPI spec no longer describes the same URL twice: the dynamic-field and filestore-file endpoints each named their path parameter differently per HTTP method, so consumers of the spec saw two colliding entries, each missing the other's operations. [SOLR-18504](https://issues.apache.org/jira/browse/SOLR-18504) (Jan Høydahl)
+- Package Uninstall should work in absence of clusterprops.json file [SOLR-18520](https://issues.apache.org/jira/browse/SOLR-18520) (Jalaz Kumar @jaykay12)
- Fix for SortedIntDocSet union affecting facet in Combined Query [SOLR-18522](https://issues.apache.org/jira/browse/SOLR-18522) (Sonu Sharma @ercsonusharma)
- The DisMax query parser no longer adds an empty, no-op boolean clause to the query when the pf parameter is blank or missing. [SOLR-504](https://issues.apache.org/jira/browse/SOLR-504) (Eric Pugh)
- ConcurrentUpdateSolrClient now identifies the target server when an update fails to connect, instead of reporting a bare connection error with no URL. [SOLR-7177](https://issues.apache.org/jira/browse/SOLR-7177) (Serhiy Bzhezytskyy)
@@ -229,7 +225,9 @@ Diagnostic logging now reports empty and skipped columns. [SOLR-18508](https://i
- Admin UI's Cloud > Tree screen now uses the v2 Zookeeper read API. Fixed a bug in that API where the per-child stat map returned by GET /api/cluster/zookeeper/children was serialized twice. [PR#4901](https://github.com/apache/solr/pull/4901) (Eric Pugh)
- Support repeated parents.preFilter values in nested vector knn queries [SOLR-18039](https://issues.apache.org/jira/browse/SOLR-18039) (Arup Chauhan @arup-chauhan)
- Don't buffer updates on replicas without update log (e.g. PULL). [SOLR-17231](https://issues.apache.org/jira/browse/SOLR-17231) (Andrzej Bialecki)
+- Fix CLUSTERSTATUS/collections-detail "health" reporting GREEN for a shard with a replica on a dead node, because health was computed before the live-node cross-check corrected that replica's stale state.json "active" entry. [SOLR-17820](https://issues.apache.org/jira/browse/SOLR-17820) (Eric Pugh)
- Fix error scenario in InstallShardData and Restore [SOLR-17821](https://issues.apache.org/jira/browse/SOLR-17821) (Houston Putman @HoustonPutman)
+- bin/solr post now honors --filetypes for files and globs, and reports the right file count. [SOLR-18031](https://issues.apache.org/jira/browse/SOLR-18031) (Amrit Sarkar)
- SOLR-18063 - NPE when resubmitting to DLQ [SOLR-18063](https://issues.apache.org/jira/browse/SOLR-18063) (Andrzej Bialecki @ab)
- CrossDC Consumer: fix potential out-of-order Kafka partition processing [SOLR-18077](https://issues.apache.org/jira/browse/SOLR-18077) (Andrzej Bialecki @ab)
- ShardRequestTracker now indexes Admin API results by node and replica rather than just node. This fixes situations where multiple sub-requests are sent to a single node. [SOLR-18081](https://issues.apache.org/jira/browse/SOLR-18081) (Houston Putman @HoustonPutman)
@@ -281,61 +279,8 @@ Diagnostic logging now reports empty and skipped columns. [SOLR-18508](https://i
- Remove Request ID based tracing. [SOLR-17934](https://issues.apache.org/jira/browse/SOLR-17934) (Eric Pugh)
- Remove dead code related to the V2 RenameCore API. Add additional tests. [PR#4172](https://github.com/apache/solr/pull/4172) (Eric Pugh)
-### Dependency Upgrades (61 changes)
-
-- Update org.eclipse.jgit:org.eclipse.jgit to v7.6.0.202603022253-r [PR#3757](https://github.com/apache/solr/pull/3757) [PR#4305](https://github.com/apache/solr/pull/4305) (solrbot)
-- Resolve Google cloud dependencies using google-cloud-bom. Bump it to 0.261.0 and grpc-bom to 1.80.0 [PR#4323](https://github.com/apache/solr/pull/4323) (solrbot) (Jan Høydahl)
-- Update Error Prone to v2.50.0 [PR#4847](https://github.com/apache/solr/pull/4847) (solrbot)
-- Update Jackson & Woodstox [PR#4977](https://github.com/apache/solr/pull/4977) (solrbot)
-- Update com.squareup.okio:okio to v3.18.2 [PR#4978](https://github.com/apache/solr/pull/4978) (solrbot)
-- Update gRPC and Netty [PR#4980](https://github.com/apache/solr/pull/4980) (solrbot)
-- Update Logging to v2.0.20 [PR#4981](https://github.com/apache/solr/pull/4981) (solrbot)
-- Update Admin UI [PR#4984](https://github.com/apache/solr/pull/4984) (solrbot)
-- Update org.apache.calcite.avatica:avatica-core to v1.29.0 [PR#4986](https://github.com/apache/solr/pull/4986) (solrbot)
-- Update Google Cloud [PR#4987](https://github.com/apache/solr/pull/4987) (solrbot)
-- Update com.github.ben-manes.versions to v0.53.0 [PR#3085](https://github.com/apache/solr/pull/3085) (solrbot)
-- Update org.apache.calcite - abandoned [PR#3119](https://github.com/apache/solr/pull/3119) (solrbot)
-- Update adobe.testing.s3mock (major) [PR#3122](https://github.com/apache/solr/pull/3122) (solrbot)
-- Update com.lmax:disruptor to v4 [PR#3127](https://github.com/apache/solr/pull/3127) (solrbot)
-- Update no.nav.security:mock-oauth2-server to v5 [PR#3133](https://github.com/apache/solr/pull/3133) (solrbot)
-- Update jakarta.servlet:jakarta.servlet-api to v6.1.0 [PR#3366](https://github.com/apache/solr/pull/3366) (solrbot)
-- Update org.immutables:value-annotations to v2.12.1 [PR#3421](https://github.com/apache/solr/pull/3421) (solrbot)
-- Update org.openapi.generator to v7.18.0 [PR#3601](https://github.com/apache/solr/pull/3601) (solrbot)
-- Update bytebuddy to v1.18.3 [PR#3764](https://github.com/apache/solr/pull/3764) (solrbot)
-- Update net.java.dev.jna:jna to v5.18.1 [PR#3781](https://github.com/apache/solr/pull/3781) (solrbot)
-- Update com.microsoft.onnxruntime:onnxruntime to v1.26.0 [PR#3790](https://github.com/apache/solr/pull/3790) (solrbot)
-- Update org.testcontainers:testcontainers to v2 [PR#3795](https://github.com/apache/solr/pull/3795) (solrbot)
-- Update org.apache.commons:commons-lang3 to v3.20.0 [PR#3873](https://github.com/apache/solr/pull/3873) (solrbot)
-- Update dev.logchange to v1.19.13 [PR#3879](https://github.com/apache/solr/pull/3879) (solrbot)
-- Update org.apache.commons:commons-text to v1.15.0 [PR#3933](https://github.com/apache/solr/pull/3933) (solrbot)
-- Update de.undercouch.download to v5.7.0 [PR#4118](https://github.com/apache/solr/pull/4118) (solrbot)
-- Update apache.log4j to v2.26.0 [PR#4339](https://github.com/apache/solr/pull/4339) (solrbot)
-- Update apache.zookeeper to v3.9.5 [PR#4340](https://github.com/apache/solr/pull/4340) (solrbot)
-- Update org.apache.tika:tika-core to v3.3.1 [PR#4349](https://github.com/apache/solr/pull/4349) (solrbot)
-- Update actions/upload-artifact action to v7 [PR#4352](https://github.com/apache/solr/pull/4352) (solrbot)
-- Update org.checkerframework:checker-qual to v4 [PR#4354](https://github.com/apache/solr/pull/4354) (solrbot)
-- Update apache.opennlp to v2.5.9 [PR#4391](https://github.com/apache/solr/pull/4391) (solrbot)
-- Update netty to v4.2.15.Final [PR#4411](https://github.com/apache/solr/pull/4411) (solrbot)
-- Update actions/labeler action to v6.1.0 [PR#4435](https://github.com/apache/solr/pull/4435) (solrbot)
-- Update actions/stale action to v10.3.0 [PR#4484](https://github.com/apache/solr/pull/4484) (solrbot)
-- Update org.eclipse.jgit:org.eclipse.jgit to v7.7.0.202606012155-r [PR#4540](https://github.com/apache/solr/pull/4540) (solrbot)
-- Update gradle/actions action to v6.2.0 [PR#4541](https://github.com/apache/solr/pull/4541) (solrbot)
-- Update actions/setup-java action to v5.4.0 [PR#4564](https://github.com/apache/solr/pull/4564) (solrbot)
-- Update actions/setup-python action to v6.3.0 [PR#4565](https://github.com/apache/solr/pull/4565) (solrbot)
-- Update io.ktor:ktor-bom to v3.5.1 [PR#4588](https://github.com/apache/solr/pull/4588) (solrbot)
-- Update Logging [PR#4590](https://github.com/apache/solr/pull/4590) (solrbot)
-- Bulk update several dependencies [PR#4591](https://github.com/apache/solr/pull/4591) (solrbot)
-- Update Telemetry (OpenTelemetry & Prometheus) [PR#4594](https://github.com/apache/solr/pull/4594) (solrbot)
-- Update com.adobe.testing:s3mock-testsupport-common to v5 [PR#4596](https://github.com/apache/solr/pull/4596) (solrbot)
-- Update Admin UI [PR#4841](https://github.com/apache/solr/pull/4841) (solrbot)
-- Update all non-major dependencies [PR#4842](https://github.com/apache/solr/pull/4842) (solrbot)
-- Update Jackson & Woodstox [PR#4844](https://github.com/apache/solr/pull/4844) (solrbot)
-- Update AWS SDK to v2.54.6 [PR#4846](https://github.com/apache/solr/pull/4846) (solrbot)
-- Update Error Prone to v2.50.0 [PR#4847](https://github.com/apache/solr/pull/4847) (solrbot)
-- Update Google Cloud [PR#4848](https://github.com/apache/solr/pull/4848) (solrbot)
-- Update gRPC and Netty [PR#4849](https://github.com/apache/solr/pull/4849) (solrbot)
-- Update OkHttp & Okio [PR#4850](https://github.com/apache/solr/pull/4850) (solrbot)
-- Update GitHub Actions (major) [PR#4854](https://github.com/apache/solr/pull/4854) (solrbot)
+### Dependency Upgrades (11 changes)
+
- Upgraded the bundled jQuery UI library (used for tooltips in the Admin UI's Cloud graph view) from an old, unversioned build to 1.13.3, resolving CVE-2021-41182, CVE-2021-41183, and CVE-2021-41184. Also added the missing jQuery UI attribution to NOTICE.txt. [SOLR-16309](https://issues.apache.org/jira/browse/SOLR-16309) (Eric Pugh)
- Introduce jersey BOM and align jersey dependencies to 3.1.11 [PR#4244](https://github.com/apache/solr/pull/4244) [SOLR-18082](https://issues.apache.org/jira/browse/SOLR-18082) (Christos Malliaridis)
- Upgrade to Lucene 10.4 [SOLR-18143](https://issues.apache.org/jira/browse/SOLR-18143) (Rahul Goswami)
@@ -343,6 +288,9 @@ Diagnostic logging now reports empty and skipped columns. [SOLR-18508](https://i
- Update apache.kafka to v4 [SOLR-18300](https://issues.apache.org/jira/browse/SOLR-18300) (Jalaz Kumar) (Eric Pugh)
- opentelemetry: the default OTLP sender is now http/protobuf port 4318 and with fewer/no JARs to do so. JARs for others like gRPC have been removed but users can add as they need. [SOLR-18310](https://issues.apache.org/jira/browse/SOLR-18310) (David Smiley)
- Upgraded the bundled d3.js library (used for the Admin UI's Cloud graph, Stream explain-tree, and Nodes disk-usage bar chart) from the decade-old 2.8.1 to 7.9.0. [SOLR-8885](https://issues.apache.org/jira/browse/SOLR-8885) (Eric Pugh)
+- Third-party dependencies added since 10.0.0: apache5-client, utils-lite 2.54.6; common, protobuf, runtime 0.13.1; google-api-services-storage-v1-rev20260524 2.0.0; joou-java-6 0.9.4; langchain4j-* (5 jars) 1.19.0; language-detection 12.5.2; opentelemetry-exporter-sender-jdk 1.65.0; opentelemetry-gcp-resources 1.37.0-alpha; opentelemetry-runtime-telemetry 2.31.1-alpha; prometheus-metrics-config, prometheus-metrics-exposition-textformats, threeten-extra 1.8.0 [solr/licenses](https://gith [...]
+- Third-party dependencies upgraded since 10.0.0: aopalliance-repackaged, hk2-api, hk2-locator, hk2-utils 3.1.1 → 4.0.1; apache-client, arns, auth, aws-core, aws-query-protocol, aws-xml-protocol, checksums, checksums-spi, crt-core, endpoints-spi, http-auth, http-auth-aws, http-auth-aws-eventstream, http-auth-spi, http-client-spi, identity-spi, json-utils, metrics-spi, profiles, protocol-core, regions, retries, retries-spi, s3, sdk-core, sts, third-party-jackson-core, utils 2.32.31 → 2.54 [...]
+- Third-party dependencies removed since 10.0.0: angus-activation 2.0.2; argparse4j 0.7.0; aws-java-sdk-core, aws-java-sdk-kms, aws-java-sdk-s3, jmespath-java 1.12.779; bcpkix-jdk15on, bcprov-jdk15on, bcutil-jdk15on 1.70; commons-beanutils 1.9.4; commons-collections 3.2.2; commons-digester 2.1; commons-validator 1.7; converter-jackson, retrofit 2.9.0; google-api-services-storage-v1-rev20240621 2.0.0; grpc-netty 1.65.1; HdrHistogram 2.2.2; httpmime 4.5.14; istack-commons-runtime 4.1.2; ja [...]
- Update eclipse.jetty to v12.0.34 [PR#4305](https://github.com/apache/solr/pull/4305) (Jan Høydahl)
### Other (36 changes)
diff --git a/changelog/v10.1.0/version-summary.md b/changelog/v10.1.0/version-summary.md
index 7bb94973b18..1fb8d7542aa 100644
--- a/changelog/v10.1.0/version-summary.md
+++ b/changelog/v10.1.0/version-summary.md
@@ -10,12 +10,6 @@
[10.1.0]
--------
-### Important notes
-
-- Per-core `/solr/{core}/replication` commands are authorized individually. `backup`, `restore`, `deletebackup`, `disablereplication`, `enablereplication`, `abortfetch`, `disablepoll`, `enablepoll`, and `fetchindex` require the `update` permission; `indexversion`, `filelist`, `filecontent`, `details`, `commits`, and `restorestatus` require `read`. A command not listed here requires `update`. Grant `update` (or `all`) to roles that invoke the state-changing commands.
-- A `filecontent` request to `/solr/{core}/replication` with `dirType=cf` or `dirType=tlogFile` must name a file that resolves inside the core's config or tlog directory; otherwise it is rejected.
-- In SolrCloud, a request served by a core on the receiving node is authorized against that core's collection, regardless of the `collection` request parameter. Requests the core sends on to other collections, such as a distributed search over several collections or an alias, are authorized by the nodes that receive them, against their own collections. For example, a search sent to a core of collection `A` with `collection=B` needs read permission on both `A` and `B`.
-
### Added (65 changes)
- New SolrJ CollectionScopedSolrClient [PR#4418](https://github.com/apache/solr/pull/4418) (David Smiley)
@@ -113,11 +107,11 @@
- Increased query throughput by removing a call to ZooKeeper for cluster state that should have been cached. Happens when Solr does distributed search over multiple collections, and when the coordinator has no local replica for some of them. [SOLR-18176](https://issues.apache.org/jira/browse/SOLR-18176) [SOLR-15352](https://issues.apache.org/jira/browse/SOLR-15352) (Matthew Biscocho)
- Move cluster concepts into Getting Started in Ref Guide [SOLR-18179](https://issues.apache.org/jira/browse/SOLR-18179) (Eric Pugh)
- JWT Authentication `blockUnknown` now defaults to `true`, blocking unauthenticated requests by default. Previously the code defaulted to `false` despite the reference guide documenting `true`. Users relying on pass-through must explicitly set `blockUnknown` to `false` in their security.json. [SOLR-18215](https://issues.apache.org/jira/browse/SOLR-18215) ([Jan Høydahl](https://home.apache.org/phonebook.html?uid=janhoy))
-- New solr.xml setting allowZkHosts limits which ZooKeeper connection strings a cross-collection join or streaming expression may use (zkHost or solrConnection); an HTTP(s) solrConnection must be a live node or be listed in allowUrls. The local SolrCloud ensemble is always allowed. zkHost and solrUrl are now mutually exclusive in a single cross-collection join clause. The local ensemble is matched verbatim, including any chroot: a node started with `-DzkHost=zk1:2181/solr` allows `zkHost [...]
-- The per-core /solr/{core}/replication endpoint is now authorized per command: state-changing commands require the "update" permission, while read-only commands continue to require "read". [SOLR-18225](https://issues.apache.org/jira/browse/SOLR-18225) (Mark Robert Miller)
-- Replication file fetching treats both "/" and "\" as path separators when validating a file name, and config/tlog file names must resolve within the core's config or tlog directory. [SOLR-18226](https://issues.apache.org/jira/browse/SOLR-18226) (Mark Robert Miller)
-- /update/extract (ExtractingRequestHandler) now requires the "update" permission rather than "read", since it indexes documents. [SOLR-18228](https://issues.apache.org/jira/browse/SOLR-18228) (Mark Robert Miller)
-- In SolrCloud, requests are authorized against the collection of the core that serves them; the "collection" request parameter is not used for authorization. [SOLR-18230](https://issues.apache.org/jira/browse/SOLR-18230) (David Smiley) (Mark Robert Miller)
+- New solr.xml setting allowZkHosts restricts the ZooKeeper hosts that cross-collection joins and streaming expressions may connect to. [SOLR-18224](https://issues.apache.org/jira/browse/SOLR-18224) [SOLR-18229](https://issues.apache.org/jira/browse/SOLR-18229) (Mark Robert Miller)
+- Replication endpoint authorization is now applied per command. [SOLR-18225](https://issues.apache.org/jira/browse/SOLR-18225) (Mark Robert Miller)
+- Replication file name validation has been tightened. [SOLR-18226](https://issues.apache.org/jira/browse/SOLR-18226) (Mark Robert Miller)
+- The /update/extract handler now requires the update permission. [SOLR-18228](https://issues.apache.org/jira/browse/SOLR-18228) (Mark Robert Miller)
+- Request authorization in SolrCloud now uses the collection of the core serving the request. [SOLR-18230](https://issues.apache.org/jira/browse/SOLR-18230) (David Smiley) (Mark Robert Miller)
- Migration of CancelTask V2 API to JAX-RS construct [SOLR-18248](https://issues.apache.org/jira/browse/SOLR-18248) (Jalaz Kumar) (Eric Pugh)
- Refactor Tasks API to use Nested Interfaces [SOLR-18248](https://issues.apache.org/jira/browse/SOLR-18248) (Jalaz Kumar)
- Restore -c option as a no-op to bin/solr start script to simplify scripts that interact with both Solr 10 and previous versions of Solr. [SOLR-18269](https://issues.apache.org/jira/browse/SOLR-18269) (Eric Pugh)
@@ -143,7 +137,7 @@ Diagnostic logging now reports empty and skipped columns. [SOLR-18508](https://i
- SolrJ v1 admin requests now use appropriate HTTP verbs -- mostly POST, some GET [SOLR-18343](https://issues.apache.org/jira/browse/SOLR-18343) (Xinyao Zhang)
- CrossDC Common optimize serialization for large docs [SOLR-18415](https://issues.apache.org/jira/browse/SOLR-18415) (Andrzej Bialecki)
-### Fixed (95 changes)
+### Fixed (99 changes)
- Fix getFirstLiveDoc so it returns the first live doc. Previously it would often return nothing resulting in missing index flags in /admin/luke response. [SOLR-18125](https://issues.apache.org/jira/browse/SOLR-18125) (Luke Kot-Zaniewski)
- using window.location.origin rather than hard coded URL [PR#4281](https://github.com/apache/solr/pull/4281) (Renato Haeberli)
@@ -194,8 +188,8 @@ Diagnostic logging now reports empty and skipped columns. [SOLR-18508](https://i
- Solr Admin UI properly supports multiple facet.field parameters [SOLR-18246](https://issues.apache.org/jira/browse/SOLR-18246) (Umut Saribiyik)
- CertAuthPlugin now uses correct Jetty attribute for certificate lookup for SSL authentication [SOLR-18270](https://issues.apache.org/jira/browse/SOLR-18270) (Jean-Marie HEITZ @heitzjm)
- Restore the parent shard to ACTIVE after a failed split even if cluster state is stale. [SOLR-18277](https://issues.apache.org/jira/browse/SOLR-18277) (Nick Shanin)
-- LoadAverageCircuitBreaker now caches its sampled value for a short TTL, so it stops re-polling the OS load average per request at high RPS. [SOLR-18284](https://issues.apache.org/jira/browse/SOLR-18284) (Mark Robert Miller)
-- MemoryCircuitBreaker now measures post-GC live heap data, so it no longer trips when the heap is full of collectible garbage. Earlier versions sampled MemoryMXBean.getHeapMemoryUsage().getUsed() on a 30-second moving average (6 samples), which trends toward max between collections during normal operation; if you tuned a threshold against that behavior you may need to revisit it. This breaks subclasses of MemoryCircuitBreaker: the deprecated MemoryCircuitBreaker(int, int) constructor is [...]
+- LoadAverageCircuitBreaker now caches its sampled load average instead of re-polling it on every request. [SOLR-18284](https://issues.apache.org/jira/browse/SOLR-18284) (Mark Robert Miller)
+- MemoryCircuitBreaker now measures post-GC live heap data, so it no longer trips on collectible garbage. [SOLR-18284](https://issues.apache.org/jira/browse/SOLR-18284) (Mark Robert Miller)
- ZkController no longer treats every ZooKeeper reconnect as session expiration. Re-election and core re-registration now run only after Curator reports ConnectionState.LOST, restoring Solr 9 behavior during ZK rolling restarts. [SOLR-18298](https://issues.apache.org/jira/browse/SOLR-18298) ([Shrey Narayan (NextBrick)](https://nextbrick.com))
- Incremental backup failures now report the original error instead of an unrelated missing zk_backup directory exception [SOLR-18303](https://issues.apache.org/jira/browse/SOLR-18303) (Prithvi S)
- Fix Thread Pool Starvation in HttpJdkSolrClient. HttpJdkSolrClient defaults would often create 32 threads, likely under-utilizing them. and it would cap threads to 256. Now it does neither by default but Executor customization (and other saturation controls) remain. [SOLR-18312](https://issues.apache.org/jira/browse/SOLR-18312) (Renato Haeberli) (David Smiley)
@@ -204,12 +198,14 @@ Diagnostic logging now reports empty and skipped columns. [SOLR-18508](https://i
- PRS based collection creation returns too early; can cause restore failure. [SOLR-18334](https://issues.apache.org/jira/browse/SOLR-18334) (David Smiley)
- /replication?command=details now reports backup details while the backup is still running, including file counts, instead of the previous backup's status [SOLR-18344](https://issues.apache.org/jira/browse/SOLR-18344) (Idan Tepper @idantepper)
- SolrJ ClientUtils.encodeLocalParamVal() can produce lossy/invalid encodings with a backslash or leading quotes. Affects faceting with a custom facet response key. Affects the SQL module for LIKE queries. [SOLR-18345](https://issues.apache.org/jira/browse/SOLR-18345) (David Smiley)
+- The metrics endpoints now answer HTTP 510 when metrics collection is disabled in solr.xml, on both the v1 and v2 API. The v1 API used to return HTTP 500, which made the Admin UI Plugins / Stats screen render blank. It now explains that metrics are disabled. [SOLR-18400](https://issues.apache.org/jira/browse/SOLR-18400) (Jan Høydahl) (Eric Pugh)
- Fix Solr emitting duplicate/conflicting JVM metrics from both runtime-telemetry-java8 and runtime-telemetry-java17 OTel scopes on Java 17, by migrating to the unified opentelemetry-runtime-telemetry module (upgraded to 2.31.1-alpha) that replaced the java8/java17 split. Also updating otel itself to 1.65.0 as well. [SOLR-18407](https://issues.apache.org/jira/browse/SOLR-18407) (Eric Pugh)
- CrossDC - ZooKeeper /crossdc.properties no longer overrides solr.crossdc.kafka.* sysprops or env vars [SOLR-18412](https://issues.apache.org/jira/browse/SOLR-18412) (Andrzej Bialecki @ab)
- Fix complement() and intersect() streaming expressions silently returning wrong results when on= maps two differently-named fields [SOLR-18418](https://issues.apache.org/jira/browse/SOLR-18418) ([David Smiley](https://home.apache.org/phonebook.html?uid=dsmiley))
- Fix a memory leak where every SolrIndexSearcher ever opened was retained by the OpenTelemetry metric registry via its "index.commit_size" observable gauge, along with its DirectoryReader and segment live-docs bitsets. Nodes with a high commit cadence would eventually run out of heap. Observable metrics registered through SolrMetricsContext with an explicit unit are now closed together with the context. [SOLR-18442](https://issues.apache.org/jira/browse/SOLR-18442) (Jan Høydahl) (Mikhai [...]
- `<metrics enabled="false"/>` in `solr.xml` now actually disables the metrics facility: no metric exporter or JVM runtime metrics are set up, and instruments are created from a no-op OpenTelemetry meter, so registries no longer accumulate metrics (and the memory they retain) for a disabled node. [SOLR-18455](https://issues.apache.org/jira/browse/SOLR-18455) ([Mikhail Khludnev](https://home.apache.org/phonebook.html?uid=mkhl) @mkhludnev)
- The OpenAPI spec no longer describes the same URL twice: the dynamic-field and filestore-file endpoints each named their path parameter differently per HTTP method, so consumers of the spec saw two colliding entries, each missing the other's operations. [SOLR-18504](https://issues.apache.org/jira/browse/SOLR-18504) (Jan Høydahl)
+- Package Uninstall should work in absence of clusterprops.json file [SOLR-18520](https://issues.apache.org/jira/browse/SOLR-18520) (Jalaz Kumar @jaykay12)
- Fix for SortedIntDocSet union affecting facet in Combined Query [SOLR-18522](https://issues.apache.org/jira/browse/SOLR-18522) (Sonu Sharma @ercsonusharma)
- The DisMax query parser no longer adds an empty, no-op boolean clause to the query when the pf parameter is blank or missing. [SOLR-504](https://issues.apache.org/jira/browse/SOLR-504) (Eric Pugh)
- ConcurrentUpdateSolrClient now identifies the target server when an update fails to connect, instead of reporting a bare connection error with no URL. [SOLR-7177](https://issues.apache.org/jira/browse/SOLR-7177) (Serhiy Bzhezytskyy)
@@ -226,7 +222,9 @@ Diagnostic logging now reports empty and skipped columns. [SOLR-18508](https://i
- Admin UI's Cloud > Tree screen now uses the v2 Zookeeper read API. Fixed a bug in that API where the per-child stat map returned by GET /api/cluster/zookeeper/children was serialized twice. [PR#4901](https://github.com/apache/solr/pull/4901) (Eric Pugh)
- Support repeated parents.preFilter values in nested vector knn queries [SOLR-18039](https://issues.apache.org/jira/browse/SOLR-18039) (Arup Chauhan @arup-chauhan)
- Don't buffer updates on replicas without update log (e.g. PULL). [SOLR-17231](https://issues.apache.org/jira/browse/SOLR-17231) (Andrzej Bialecki)
+- Fix CLUSTERSTATUS/collections-detail "health" reporting GREEN for a shard with a replica on a dead node, because health was computed before the live-node cross-check corrected that replica's stale state.json "active" entry. [SOLR-17820](https://issues.apache.org/jira/browse/SOLR-17820) (Eric Pugh)
- Fix error scenario in InstallShardData and Restore [SOLR-17821](https://issues.apache.org/jira/browse/SOLR-17821) (Houston Putman @HoustonPutman)
+- bin/solr post now honors --filetypes for files and globs, and reports the right file count. [SOLR-18031](https://issues.apache.org/jira/browse/SOLR-18031) (Amrit Sarkar)
- SOLR-18063 - NPE when resubmitting to DLQ [SOLR-18063](https://issues.apache.org/jira/browse/SOLR-18063) (Andrzej Bialecki @ab)
- CrossDC Consumer: fix potential out-of-order Kafka partition processing [SOLR-18077](https://issues.apache.org/jira/browse/SOLR-18077) (Andrzej Bialecki @ab)
- ShardRequestTracker now indexes Admin API results by node and replica rather than just node. This fixes situations where multiple sub-requests are sent to a single node. [SOLR-18081](https://issues.apache.org/jira/browse/SOLR-18081) (Houston Putman @HoustonPutman)
@@ -278,61 +276,8 @@ Diagnostic logging now reports empty and skipped columns. [SOLR-18508](https://i
- Remove Request ID based tracing. [SOLR-17934](https://issues.apache.org/jira/browse/SOLR-17934) (Eric Pugh)
- Remove dead code related to the V2 RenameCore API. Add additional tests. [PR#4172](https://github.com/apache/solr/pull/4172) (Eric Pugh)
-### Dependency Upgrades (61 changes)
+### Dependency Upgrades (11 changes)
-- Update org.eclipse.jgit:org.eclipse.jgit to v7.6.0.202603022253-r [PR#3757](https://github.com/apache/solr/pull/3757) [PR#4305](https://github.com/apache/solr/pull/4305) (solrbot)
-- Resolve Google cloud dependencies using google-cloud-bom. Bump it to 0.261.0 and grpc-bom to 1.80.0 [PR#4323](https://github.com/apache/solr/pull/4323) (solrbot) (Jan Høydahl)
-- Update Error Prone to v2.50.0 [PR#4847](https://github.com/apache/solr/pull/4847) (solrbot)
-- Update Jackson & Woodstox [PR#4977](https://github.com/apache/solr/pull/4977) (solrbot)
-- Update com.squareup.okio:okio to v3.18.2 [PR#4978](https://github.com/apache/solr/pull/4978) (solrbot)
-- Update gRPC and Netty [PR#4980](https://github.com/apache/solr/pull/4980) (solrbot)
-- Update Logging to v2.0.20 [PR#4981](https://github.com/apache/solr/pull/4981) (solrbot)
-- Update Admin UI [PR#4984](https://github.com/apache/solr/pull/4984) (solrbot)
-- Update org.apache.calcite.avatica:avatica-core to v1.29.0 [PR#4986](https://github.com/apache/solr/pull/4986) (solrbot)
-- Update Google Cloud [PR#4987](https://github.com/apache/solr/pull/4987) (solrbot)
-- Update com.github.ben-manes.versions to v0.53.0 [PR#3085](https://github.com/apache/solr/pull/3085) (solrbot)
-- Update org.apache.calcite - abandoned [PR#3119](https://github.com/apache/solr/pull/3119) (solrbot)
-- Update adobe.testing.s3mock (major) [PR#3122](https://github.com/apache/solr/pull/3122) (solrbot)
-- Update com.lmax:disruptor to v4 [PR#3127](https://github.com/apache/solr/pull/3127) (solrbot)
-- Update no.nav.security:mock-oauth2-server to v5 [PR#3133](https://github.com/apache/solr/pull/3133) (solrbot)
-- Update jakarta.servlet:jakarta.servlet-api to v6.1.0 [PR#3366](https://github.com/apache/solr/pull/3366) (solrbot)
-- Update org.immutables:value-annotations to v2.12.1 [PR#3421](https://github.com/apache/solr/pull/3421) (solrbot)
-- Update org.openapi.generator to v7.18.0 [PR#3601](https://github.com/apache/solr/pull/3601) (solrbot)
-- Update bytebuddy to v1.18.3 [PR#3764](https://github.com/apache/solr/pull/3764) (solrbot)
-- Update net.java.dev.jna:jna to v5.18.1 [PR#3781](https://github.com/apache/solr/pull/3781) (solrbot)
-- Update com.microsoft.onnxruntime:onnxruntime to v1.26.0 [PR#3790](https://github.com/apache/solr/pull/3790) (solrbot)
-- Update org.testcontainers:testcontainers to v2 [PR#3795](https://github.com/apache/solr/pull/3795) (solrbot)
-- Update org.apache.commons:commons-lang3 to v3.20.0 [PR#3873](https://github.com/apache/solr/pull/3873) (solrbot)
-- Update dev.logchange to v1.19.13 [PR#3879](https://github.com/apache/solr/pull/3879) (solrbot)
-- Update org.apache.commons:commons-text to v1.15.0 [PR#3933](https://github.com/apache/solr/pull/3933) (solrbot)
-- Update de.undercouch.download to v5.7.0 [PR#4118](https://github.com/apache/solr/pull/4118) (solrbot)
-- Update apache.log4j to v2.26.0 [PR#4339](https://github.com/apache/solr/pull/4339) (solrbot)
-- Update apache.zookeeper to v3.9.5 [PR#4340](https://github.com/apache/solr/pull/4340) (solrbot)
-- Update org.apache.tika:tika-core to v3.3.1 [PR#4349](https://github.com/apache/solr/pull/4349) (solrbot)
-- Update actions/upload-artifact action to v7 [PR#4352](https://github.com/apache/solr/pull/4352) (solrbot)
-- Update org.checkerframework:checker-qual to v4 [PR#4354](https://github.com/apache/solr/pull/4354) (solrbot)
-- Update apache.opennlp to v2.5.9 [PR#4391](https://github.com/apache/solr/pull/4391) (solrbot)
-- Update netty to v4.2.15.Final [PR#4411](https://github.com/apache/solr/pull/4411) (solrbot)
-- Update actions/labeler action to v6.1.0 [PR#4435](https://github.com/apache/solr/pull/4435) (solrbot)
-- Update actions/stale action to v10.3.0 [PR#4484](https://github.com/apache/solr/pull/4484) (solrbot)
-- Update org.eclipse.jgit:org.eclipse.jgit to v7.7.0.202606012155-r [PR#4540](https://github.com/apache/solr/pull/4540) (solrbot)
-- Update gradle/actions action to v6.2.0 [PR#4541](https://github.com/apache/solr/pull/4541) (solrbot)
-- Update actions/setup-java action to v5.4.0 [PR#4564](https://github.com/apache/solr/pull/4564) (solrbot)
-- Update actions/setup-python action to v6.3.0 [PR#4565](https://github.com/apache/solr/pull/4565) (solrbot)
-- Update io.ktor:ktor-bom to v3.5.1 [PR#4588](https://github.com/apache/solr/pull/4588) (solrbot)
-- Update Logging [PR#4590](https://github.com/apache/solr/pull/4590) (solrbot)
-- Bulk update several dependencies [PR#4591](https://github.com/apache/solr/pull/4591) (solrbot)
-- Update Telemetry (OpenTelemetry & Prometheus) [PR#4594](https://github.com/apache/solr/pull/4594) (solrbot)
-- Update com.adobe.testing:s3mock-testsupport-common to v5 [PR#4596](https://github.com/apache/solr/pull/4596) (solrbot)
-- Update Admin UI [PR#4841](https://github.com/apache/solr/pull/4841) (solrbot)
-- Update all non-major dependencies [PR#4842](https://github.com/apache/solr/pull/4842) (solrbot)
-- Update Jackson & Woodstox [PR#4844](https://github.com/apache/solr/pull/4844) (solrbot)
-- Update AWS SDK to v2.54.6 [PR#4846](https://github.com/apache/solr/pull/4846) (solrbot)
-- Update Error Prone to v2.50.0 [PR#4847](https://github.com/apache/solr/pull/4847) (solrbot)
-- Update Google Cloud [PR#4848](https://github.com/apache/solr/pull/4848) (solrbot)
-- Update gRPC and Netty [PR#4849](https://github.com/apache/solr/pull/4849) (solrbot)
-- Update OkHttp & Okio [PR#4850](https://github.com/apache/solr/pull/4850) (solrbot)
-- Update GitHub Actions (major) [PR#4854](https://github.com/apache/solr/pull/4854) (solrbot)
- Upgraded the bundled jQuery UI library (used for tooltips in the Admin UI's Cloud graph view) from an old, unversioned build to 1.13.3, resolving CVE-2021-41182, CVE-2021-41183, and CVE-2021-41184. Also added the missing jQuery UI attribution to NOTICE.txt. [SOLR-16309](https://issues.apache.org/jira/browse/SOLR-16309) (Eric Pugh)
- Introduce jersey BOM and align jersey dependencies to 3.1.11 [PR#4244](https://github.com/apache/solr/pull/4244) [SOLR-18082](https://issues.apache.org/jira/browse/SOLR-18082) (Christos Malliaridis)
- Upgrade to Lucene 10.4 [SOLR-18143](https://issues.apache.org/jira/browse/SOLR-18143) (Rahul Goswami)
@@ -340,6 +285,9 @@ Diagnostic logging now reports empty and skipped columns. [SOLR-18508](https://i
- Update apache.kafka to v4 [SOLR-18300](https://issues.apache.org/jira/browse/SOLR-18300) (Jalaz Kumar) (Eric Pugh)
- opentelemetry: the default OTLP sender is now http/protobuf port 4318 and with fewer/no JARs to do so. JARs for others like gRPC have been removed but users can add as they need. [SOLR-18310](https://issues.apache.org/jira/browse/SOLR-18310) (David Smiley)
- Upgraded the bundled d3.js library (used for the Admin UI's Cloud graph, Stream explain-tree, and Nodes disk-usage bar chart) from the decade-old 2.8.1 to 7.9.0. [SOLR-8885](https://issues.apache.org/jira/browse/SOLR-8885) (Eric Pugh)
+- Third-party dependencies added since 10.0.0: apache5-client, utils-lite 2.54.6; common, protobuf, runtime 0.13.1; google-api-services-storage-v1-rev20260524 2.0.0; joou-java-6 0.9.4; langchain4j-* (5 jars) 1.19.0; language-detection 12.5.2; opentelemetry-exporter-sender-jdk 1.65.0; opentelemetry-gcp-resources 1.37.0-alpha; opentelemetry-runtime-telemetry 2.31.1-alpha; prometheus-metrics-config, prometheus-metrics-exposition-textformats, threeten-extra 1.8.0 [solr/licenses](https://gith [...]
+- Third-party dependencies upgraded since 10.0.0: aopalliance-repackaged, hk2-api, hk2-locator, hk2-utils 3.1.1 → 4.0.1; apache-client, arns, auth, aws-core, aws-query-protocol, aws-xml-protocol, checksums, checksums-spi, crt-core, endpoints-spi, http-auth, http-auth-aws, http-auth-aws-eventstream, http-auth-spi, http-client-spi, identity-spi, json-utils, metrics-spi, profiles, protocol-core, regions, retries, retries-spi, s3, sdk-core, sts, third-party-jackson-core, utils 2.32.31 → 2.54 [...]
+- Third-party dependencies removed since 10.0.0: angus-activation 2.0.2; argparse4j 0.7.0; aws-java-sdk-core, aws-java-sdk-kms, aws-java-sdk-s3, jmespath-java 1.12.779; bcpkix-jdk15on, bcprov-jdk15on, bcutil-jdk15on 1.70; commons-beanutils 1.9.4; commons-collections 3.2.2; commons-digester 2.1; commons-validator 1.7; converter-jackson, retrofit 2.9.0; google-api-services-storage-v1-rev20240621 2.0.0; grpc-netty 1.65.1; HdrHistogram 2.2.2; httpmime 4.5.14; istack-commons-runtime 4.1.2; ja [...]
- Update eclipse.jetty to v12.0.34 [PR#4305](https://github.com/apache/solr/pull/4305) (Jan Høydahl)
### Other (36 changes)