Merge remote-tracking branch 'upstream/main' into SOLR-17949-azure-blob-repository

prateeksinghalgit · prateeksinghalgit · commit 1e832a71737f · 2026-07-02T11:44:29.000-07:00
Co-authored-by: Cursor &lt;cursoragent@cursor.com&gt;

# Conflicts:
#	gradle/libs.versions.toml
diff --git a/.github/renovate.json b/.github/renovate.json
@@ -28,45 +28,136 @@
       "versioning": "regex:^(?<major>\\d{1,4})\\.(?<minor>\\d+)(\\.(?<patch>\\d+))?$"
     },
     {
-      "description": "Group these calcite dependency upgrades together in same PR",
-      "matchPackagePrefixes": ["org.apache.calcite"],
-      "groupName": "org.apache.calcite"
+      "description": "Byte Buddy publishes a -jdk5 backport variant alongside each release (e.g. 1.18.10-jdk5). Ignore those so we track the mainline versions (e.g. 1.18.10).",
+      "matchPackagePrefixes": ["net.bytebuddy"],
+      "allowedVersions": "!/-jdk5$/"
     },
     {
-      "description": "Group these httpcomponents dependency upgrades together in same PR",
-      "matchPackagePrefixes": ["org.apache.httpcomponents"],
-      "groupName": "org.apache.httpcomponents"
+      "description": "CATCH-ALL: bundle all remaining minor/patch bumps of otherwise-ungrouped libraries into one PR to cut churn. Major bumps are intentionally NOT grouped here - they stay as individual PRs. The test bucket and the logical groups below override this for their packages.",
+      "matchManagers": ["gradle"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "all non-major dependencies"
     },
     {
-      "description": "Test-dependencies are checked less often than the shipped deps",
+      "description": "CATCH-ALL for test-only deps: bundle their minor/patch bumps separately from shipped deps. Major bumps stay individual.",
+      "matchManagers": ["gradle"],
       "matchDepTypes": ["test"],
-      "schedule": ["before 9am on the first day of the month"]
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "all non-major test dependencies"
+    },
+    {
+      "description": "Admin UI (Kotlin Multiplatform / Compose stack in solr/ui) - compose, androidx, kotlin(x), decompose/essenty/mvikotlin, ktor and kotlin-logging all move together. The Compose compiler plugin is version-locked to the Kotlin release.",
+      "matchPackagePrefixes": [
+        "org.jetbrains.kotlin",
+        "org.jetbrains.compose",
+        "org.jetbrains.androidx",
+        "com.arkivanov",
+        "io.ktor",
+        "io.github.oshai"
+      ],
+      "groupName": "Admin UI"
+    },
+    {
+      "description": "Web/server stack - Jetty servlet container, the Jakarta EE APIs, and the Jersey (JAX-RS) impl with its HK2 DI. solr/core wires jersey-container-jetty-http + jersey-inject-hk2 + jakarta APIs onto Jetty, so they must stay compatible.",
+      "matchPackagePrefixes": [
+        "org.eclipse.jetty",
+        "jakarta.",
+        "org.glassfish.jersey",
+        "org.glassfish.hk2"
+      ],
+      "groupName": "Web server stack"
+    },
+    {
+      "description": "gRPC / Netty / protobuf transport stack - grpc-netty uses Netty as its transport and grpc-protobuf uses protobuf. Shared by both the OpenTelemetry OTLP exporter and the GCS client, so it is its own group rather than owned by either.",
+      "matchPackagePrefixes": [
+        "io.grpc",
+        "io.netty",
+        "com.google.protobuf"
+      ],
+      "groupName": "gRPC and Netty"
+    },
+    {
+      "description": "Telemetry - OpenTelemetry API/SDK/exporters/instrumentation plus the Prometheus metrics libraries it exports to (solr/core uses otel-exporter-prometheus with prometheus-metrics-*).",
+      "matchPackagePrefixes": [
+        "io.opentelemetry",
+        "io.prometheus"
+      ],
+      "groupName": "Telemetry (OpenTelemetry & Prometheus)"
+    },
+    {
+      "description": "Google Cloud client stack used by the GCS repository - cloud client, api and auth libraries plus the BOM. Kept separate from the gRPC transport it consumes and from general com.google.* utility libs (guava, gson, errorprone).",
+      "matchPackagePrefixes": [
+        "com.google.cloud",
+        "com.google.api",
+        "com.google.auth"
+      ],
+      "groupName": "Google Cloud"
+    },
+    {
+      "description": "FasterXML Jackson and the Woodstox XML stack - jackson-bom family, plus woodstox-core (com.fasterxml.woodstox) and its required stax2-api (org.codehaus.woodstox), which are used together in solr/core.",
+      "matchPackagePrefixes": [
+        "com.fasterxml.jackson",
+        "com.fasterxml.woodstox",
+        "org.codehaus.woodstox"
+      ],
+      "groupName": "Jackson & Woodstox"
+    },
+    {
+      "description": "Logging stack - Log4j, SLF4J (the log4j-slf4j2-impl bridge and jul/jcl bridges tie them together) and LMAX Disruptor, which is only present for Log4j2 async logging.",
+      "matchPackagePrefixes": [
+        "org.apache.logging.log4j",
+        "org.slf4j",
+        "com.lmax"
+      ],
+      "groupName": "Logging"
+    },
+    {
+      "description": "ZooKeeper and Curator - Curator is a ZooKeeper client library and must stay compatible with the ZooKeeper version.",
+      "matchPackagePrefixes": [
+        "org.apache.zookeeper",
+        "org.apache.curator"
+      ],
+      "groupName": "ZooKeeper & Curator"
     },
     {
-      "description": "AWS SDK packages checked less often",
+      "description": "Calcite (calcite-core/linq4j + avatica) must move together",
+      "matchPackagePrefixes": ["org.apache.calcite"],
+      "groupName": "Calcite"
+    },
+    {
+      "description": "Apache HttpComponents (httpclient/httpcore/httpmime) must move together",
+      "matchPackagePrefixes": ["org.apache.httpcomponents"],
+      "groupName": "Apache HttpComponents"
+    },
+    {
+      "description": "AWS SDK - single BOM-aligned version across ~11 artifacts",
       "matchPackagePrefixes": ["software.amazon.awssdk"],
-      "groupName": "AWS SDK",
-      "schedule": ["before 9am on the first day of the month"]
+      "groupName": "AWS SDK"
     },
     {
-      "description": "Google Cloud BOM checked less often to avoid spam",
-      "matchPackageNames": ["com.google.cloud:google-cloud-bom"],
-      "schedule": ["before 9am on the first day of the month"]
+      "description": "OkHttp and Okio - okhttp depends on a compatible okio",
+      "matchPackagePrefixes": ["com.squareup.okhttp3", "com.squareup.okio"],
+      "groupName": "OkHttp & Okio"
     },
     {
-      "description": "Workaround for https://github.com/renovatebot/renovate/issues/19226",
-      "matchPackageNames": ["solr:modules", "HH:mm"],
+      "description": "Skip major jetty upgrades - must be done manually (overrides the Web server stack group above for jetty majors only)",
+      "matchPackagePrefixes": ["org.eclipse.jetty"],
+      "matchUpdateTypes": ["major"],
       "enabled": false
     },
     {
-      "description": "Lucene dependencies should be skipped",
+      "description": "Lucene dependencies should be skipped (upgraded together with the Lucene release)",
       "matchPackagePrefixes": ["org.apache.lucene"],
       "enabled": false
     },
     {
-      "description": "Skip major jetty upgrades - must be done manually",
-      "matchPackagePrefixes": ["org.eclipse.jetty"],
-      "matchUpdateTypes": ["major"],
+      "description": "Lock cuvs-lucene below v26 - the 26.x line is compiled for JDK 22 (class file major version 66) but Solr targets JDK 21, so it fails to compile (see PR #4134). Revisit when Solr's minimum JDK is raised.",
+      "matchPackageNames": ["com.nvidia.cuvs.lucene:cuvs-lucene"],
+      "allowedVersions": "<26"
+    },
+    {
+      "description": "Workaround for https://github.com/renovatebot/renovate/issues/19226",
+      "matchPackageNames": ["solr:modules", "HH:mm"],
       "enabled": false
     },
     {
@@ -96,18 +187,12 @@
       "changelogUrl": "https://commons.apache.org/proper/commons-configuration/changes-report.html"
     },
     {
-      "description": "Group these UI dependency upgrades together in same PR",
-      "matchPackagePrefixes": ["com.arkivanov", "org.jetbrains.compose"],
-      "groupName": "Admin UI libraries"
-    },
-    {
-      "description": "Group all GitHub Actions upgrades together in same PR, checked once per month",
+      "description": "Group all GitHub Actions upgrades together in same PR",
       "matchManagers": ["github-actions"],
-      "groupName": "GitHub Actions",
-      "schedule": ["before 9am on the first day of the month"]
+      "groupName": "GitHub Actions"
     }
   ],
-  "schedule": ["* * * * 0"],
+  "schedule": ["* * * * *"],
   "prConcurrentLimit": 300,
   "prHourlyLimit": 20,
   "minimumReleaseAge": "5 days"
diff --git a/.github/workflows/bin-solr-test.yml b/.github/workflows/bin-solr-test.yml
@@ -23,7 +23,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     - uses: ./.github/actions/prepare-for-build
 
diff --git a/.github/workflows/dependency-graph-submission.yml b/.github/workflows/dependency-graph-submission.yml
@@ -11,7 +11,7 @@ jobs:
   dependency-submission:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
         with:
diff --git a/.github/workflows/docker-nightly.yml b/.github/workflows/docker-nightly.yml
@@ -74,7 +74,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ matrix.branch }}
 
@@ -86,7 +86,7 @@ jobs:
           java-package: jdk
 
       - name: Cache gradle-wrapper.jar
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: gradle/wrapper/gradle-wrapper.jar
           key: gradle-wrapper-${{ hashFiles('gradle/wrapper/gradle-wrapper.jar.sha256') }}
@@ -119,7 +119,7 @@ jobs:
           EOF
 
       - name: Set up QEMU for multi-platform builds
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
diff --git a/.github/workflows/docker-test.yml b/.github/workflows/docker-test.yml
@@ -27,7 +27,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     - uses: ./.github/actions/prepare-for-build
 
diff --git a/.github/workflows/gradle-extraction-check.yml b/.github/workflows/gradle-extraction-check.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: ./.github/actions/prepare-for-build
 
diff --git a/.github/workflows/gradle-precommit.yml b/.github/workflows/gradle-precommit.yml
@@ -18,7 +18,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     - uses: ./.github/actions/prepare-for-build
 
diff --git a/.github/workflows/renovate-changelog-prepare.yml b/.github/workflows/renovate-changelog-prepare.yml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Checkout BASE repository at base branch (NOT fork code)
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.pull_request.base.ref }}
           repository: ${{ github.repository }}
diff --git a/.github/workflows/solrj-test.yml b/.github/workflows/solrj-test.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     - uses: ./.github/actions/prepare-for-build
 
diff --git a/.github/workflows/validate-changelog.yml b/.github/workflows/validate-changelog.yml
@@ -18,7 +18,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         fetch-depth: 0
 
diff --git a/build.gradle b/build.gradle
@@ -27,7 +27,6 @@ plugins {
   alias(libs.plugins.kotlin.multiplatform) apply false
   alias(libs.plugins.littlerobots.versioncatalogupdate) apply false
   alias(libs.plugins.thetaphi.forbiddenapis) apply false
-  alias(libs.plugins.undercouch.download) apply false
   alias(libs.plugins.ltgt.errorprone) apply false
   alias(libs.plugins.diffplug.spotless) apply false
   alias(libs.plugins.nodegradle.node) apply false
diff --git a/changelog/unreleased/PR#4354-update-org-checkerframework-checker-qual.yml b/changelog/unreleased/PR#4354-update-org-checkerframework-checker-qual.yml
@@ -0,0 +1,7 @@
+title: Update org.checkerframework:checker-qual to v4
+type: dependency_update
+authors:
+- name: solrbot
+links:
+- name: PR#4354
+  url: https://github.com/apache/solr/pull/4354
diff --git a/dev-docs/dependency-upgrades.adoc b/dev-docs/dependency-upgrades.adoc
@@ -70,15 +70,26 @@ changes resulting from the gradle tasks `resolveAndLockAll` and `updateLicenses`
 Community members and committers can then review, and if manual changes are needed, help bring the PR to completion.
 For many dependencies, a changelog is included in the PR text, which may help guide the upgrade decision.
 
-The scans are run on a schedule. New PRs are filed every Sunday, and only dependency versions that are at least
-5 days old are suggested, to guard against bad apples. If a new *major* version of a dependency is available,
-that will get its own separate Pull Request, so you can choose.
+The scans are run on a schedule. New PRs are filed once a month (before 9am on the first day of the month), and only
+dependency versions that are at least 5 days old are suggested, to guard against bad apples. Since Solr only releases
+every couple of months, a monthly cadence keeps the number of open dependency PRs manageable. A Release Manager who
+wants to be on the very latest right before a release can temporarily switch to a more frequent schedule (e.g.
+`["* * * * 0"]` for weekly) by editing `renovate.json`.
+
+To further cut down on the number of tiny PRs, upgrades are *grouped*. There are a handful of logical groups for
+libraries that must stay version-compatible (e.g. Admin UI, Web server stack, Logging), and then two large
+catch-all groups - "all non-major dependencies" and "all non-major test dependencies" - that bundle the *minor and
+patch* bumps of everything else. *Major* bumps are never grouped; each gets its own PR for individual review. See
+`renovate.json` for the exact group definitions.
 
 If an upgrade is decided, simply merge (and backport) the PR. To skip an upgrade, close the PR. If a PR is left open,
 it will be re-used and auto updated whenever a newer patch- or minor version gets available. Thus, one can reduce
 churn from frequently-updated dependencies by delaying merge until a few weeks before a new release. One can also
 choose to change to a less frequent schedule or disable the bot, by editing `renovate.json`.
 
+The `branch_9x` branch has its own `renovate.json` that layers on top of (and inherits from) this one, overriding only
+the schedule and the lockfile/license commands. Grouping rules defined here therefore apply to `branch_9x` too.
+
 Please note that Solr version prior to 10.X use a versions resolution plugin that uses `versions.lock` instead of
 `libs.version.toml`. Therefore, changes cannot be backported via cherry-pick.
 
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
@@ -53,12 +53,14 @@ asciidoctor-mathjax = "0.0.9"
 asciidoctor-tabs = "1.0.0-beta.6"
 azagniotov-langdetect = "12.5.2"
 azure-sdk-bom = "1.3.6"
-# @keep bats-assert (node) version used in packaging
+# @keep bats-assert version used in packaging
 bats-assert = "2.0.0"
-# @keep bats-core (node) version used in packaging
+# @keep bats-core version used in packaging
 bats-core = "1.8.2"
-# @keep bats-file (node) version used in packaging
+# @keep bats-file version used in packaging
 bats-file = "0.3.0"
+# @keep bats-support version used in packaging
+bats-support = "0.2.0"
 bc-jose4j = "0.9.6"
 benmanes-caffeine = "3.2.3"
 benmanes-versions = "0.53.0"
@@ -70,7 +72,7 @@ carrot2-core = "4.8.1"
 carrotsearch-hppc = "0.10.0"
 carrotsearch-randomizedtesting = "2.8.4"
 # @keep for version alignment
-checkerframework = "3.54.0"
+checkerframework = "4.2.0"
 codehaus-woodstox = "4.3.0"
 commons-cli = "1.11.0"
 commons-codec = "1.22.0"
@@ -197,7 +199,6 @@ tdunning-tdigest = "3.3"
 testcontainers = "2.0.5"
 thetaphi-forbiddenapis = "3.10"
 threeten-bp = "1.7.3"
-undercouch-download = "5.7.0"
 xerial-snappy = "1.1.10.8"
 
 [plugins]
@@ -216,7 +217,6 @@ openapi-generator = { id = "org.openapi.generator", version.ref = "openapi" }
 owasp-dependencycheck = { id = "org.owasp.dependencycheck", version.ref = "owasp-dependencycheck" }
 swagger3-core = { id = "io.swagger.core.v3.swagger-gradle-plugin", version.ref = "swagger3" }
 thetaphi-forbiddenapis = { id = "de.thetaphi.forbiddenapis", version.ref = "thetaphi-forbiddenapis" }
-undercouch-download = { id = "de.undercouch.download", version.ref = "undercouch-download" }
 
 [libraries]
 adobe-testing-s3mock-junit4 = { module = "com.adobe.testing:s3mock-junit4", version.ref = "adobe-testing-s3mock" }
diff --git a/gradle/node.gradle b/gradle/node.gradle
@@ -15,7 +15,7 @@
  * limitations under the License.
  */
 
-configure([project(":solr:packaging"), project(":solr:solr-ref-guide"), project(":solr:webapp")]) {
+configure([project(":solr:solr-ref-guide"), project(":solr:webapp")]) {
   apply plugin: libs.plugins.nodegradle.node.get().pluginId
 
   def npmRegistry = "${-> propertyOrEnvOrDefault("solr.npm.registry", "SOLR_NPM_REGISTRY", '')}"
diff --git a/solr/core/src/java/org/apache/solr/search/BoolQParserPlugin.java b/solr/core/src/java/org/apache/solr/search/BoolQParserPlugin.java
@@ -22,7 +22,6 @@
 import org.apache.lucene.search.BooleanClause;
 import org.apache.lucene.search.BooleanQuery;
 import org.apache.lucene.search.Query;
-import org.apache.solr.common.params.DisMaxParams;
 import org.apache.solr.common.params.SolrParams;
 import org.apache.solr.query.FilterQuery;
 import org.apache.solr.request.SolrQueryRequest;
@@ -50,10 +49,8 @@ public Query parse() throws SyntaxError {
       @Override
       protected BooleanQuery parseImpl() throws SyntaxError {
         BooleanQuery query = super.parseImpl();
-        SolrParams solrParams = SolrParams.wrapDefaults(localParams, params);
-        String minShouldMatch = SolrPluginUtils.parseMinShouldMatch(req.getSchema(), solrParams);
-        boolean mmAutoRelax = params.getBool(DisMaxParams.MM_AUTORELAX, false);
-        return SolrPluginUtils.setMinShouldMatch(query, minShouldMatch, mmAutoRelax);
+        String minShouldMatch = SolrPluginUtils.parseMinShouldMatch(req.getSchema(), localParams);
+        return SolrPluginUtils.setMinShouldMatch(query, minShouldMatch, false);
       }
 
       @Override
diff --git a/solr/licenses/checker-qual-3.54.0.jar.sha1 b/solr/licenses/checker-qual-3.54.0.jar.sha1
diff --git a/solr/licenses/checker-qual-4.2.0.jar.sha1 b/solr/licenses/checker-qual-4.2.0.jar.sha1
diff --git a/solr/modules/azure-blob-repository/gradle.lockfile b/solr/modules/azure-blob-repository/gradle.lockfile
diff --git a/solr/modules/gcs-repository/gradle.lockfile b/solr/modules/gcs-repository/gradle.lockfile
diff --git a/solr/modules/sql/gradle.lockfile b/solr/modules/sql/gradle.lockfile
diff --git a/solr/packaging/build.gradle b/solr/packaging/build.gradle
diff --git a/solr/solr-ref-guide/gradle.lockfile b/solr/solr-ref-guide/gradle.lockfile
diff --git a/solr/solrj-streaming/gradle.lockfile b/solr/solrj-streaming/gradle.lockfile
