Merge remote-tracking branch 'apache/main' into SOLR-16427/class-init…

…ialization-deadlock

# Conflicts:
#	solr/core/src/test/org/apache/solr/handler/admin/IndexSizeEstimatorTest.java
#	solr/solrj/src/java/org/apache/solr/common/cloud/DocRouter.java

.asf.yaml

@@ -29,6 +29,7 @@ github:
     branch_9_5: {}
     branch_9_6: {}
     branch_9_7: {}
+    branch_9_8: {}
     branch_9x: {}
 
   protected_tags:

.gitattributes

@@ -1,5 +1,6 @@
-# Ignore all differences in line endings for the lock file.
+# Ignore all differences in line endings for lock files.
 versions.lock text eol=lf
+**/*.lockfile text eol=lf
 
 # Gradle files are always in LF.
 *.gradle          text eol=lf

.github/labeler.yml

@@ -2,10 +2,11 @@
 dependencies:
   - changed-files:
       - any-glob-to-any-file:
-        - gradle/libs.versions.toml # Solr 10+
-        - versions.props # Solr < v10
-        - versions.lock
-        - solr/licenses/**
+        - "gradle/libs.versions.toml" # Solr 10+
+        - "**/*.lockfile"
+        - "versions.props" # Solr < v10
+        - "versions.lock"
+        - "solr/licenses/**"
 
 # Add 'documentation' label to any changes within ref-guide or dev-docs
 documentation:
@@ -95,6 +96,7 @@ admin-ui:
   - changed-files:
       - any-glob-to-any-file:
           - solr/webapp/**
+          - solr/ui/**
 
 # Add 'prometheus-exporter' label
 prometheus-exporter:
@@ -123,11 +125,6 @@ module:gcs-repository:
       - any-glob-to-any-file:
           - solr/modules/gcs-repository/**
 
-module:hadoop-auth:
-  - changed-files:
-      - any-glob-to-any-file:
-          - solr/modules/hadoop-auth/**
-
 module:hdfs:
   - changed-files:
       - any-glob-to-any-file:

.github/renovate.json

@@ -4,9 +4,13 @@
   "enabled": true,
   "dependencyDashboard": false,
   "enabledManagers": ["gradle", "github-actions"],
-  "includePaths": ["versions.*", "build.gradle", ".github/workflows/*"],
+  "includePaths": ["gradle/libs.versions.toml", "versions.*", "build.gradle", ".github/workflows/*"],
   "postUpgradeTasks": {
-    "commands": ["./gradlew updateLicenses"],
+    "commands": [
+      "./gradlew resolveAndLockAll --write-locks",
+      "./gradlew kotlinUpgradeYarnLock",
+      "./gradlew updateLicenses"
+    ],
     "fileFilters": ["solr/licenses/*.sha1"],
     "executionMode": "branch"
   },

.github/workflows/bin-solr-test.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
 
     env:
-      DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
+      DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
     steps:
     # Setup
@@ -38,7 +38,7 @@ jobs:
       with:
         path: |
           ~/.gradle/caches
-        key: ${{ runner.os }}-gradle-binsolr-${{ hashFiles('versions.lock') }}
+        key: ${{ runner.os }}-gradle-binsolr-${{ hashFiles('**/*.lockfile') }}
         restore-keys: |
           ${{ runner.os }}-gradle-binsolr-
           ${{ runner.os }}-gradle-

.github/workflows/docker-test.yml

@@ -21,7 +21,7 @@ jobs:
     env:
       SOLR_DOCKER_IMAGE_REPO: github-pr/solr
       SOLR_DOCKER_IMAGE_TAG: ${{github.event.number}}
-      DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
+      DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
     steps:
     # Setup
@@ -42,7 +42,7 @@ jobs:
       with:
         path: |
           ~/.gradle/caches
-        key: ${{ runner.os }}-gradle-docker-${{ hashFiles('versions.lock') }}
+        key: ${{ runner.os }}-gradle-docker-${{ hashFiles('**/*.lockfile') }}
         restore-keys: |
           ${{ runner.os }}-gradle-docker-
           ${{ runner.os }}-gradle-

.github/workflows/gradle-precommit.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
 
     env:
-      DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
+      DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
     steps:
     # Setup
@@ -36,7 +36,7 @@ jobs:
       with:
         path: |
           ~/.gradle/caches
-        key: ${{ runner.os }}-gradle-precommit-${{ hashFiles('versions.lock') }}
+        key: ${{ runner.os }}-gradle-precommit-${{ hashFiles('**/*.lockfile') }}
         restore-keys: |
           ${{ runner.os }}-gradle-precommit-
           ${{ runner.os }}-gradle-

.github/workflows/solrj-test.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
 
     env:
-      DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
+      DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
     steps:
     # Setup
@@ -35,7 +35,7 @@ jobs:
       with:
         path: |
           ~/.gradle/caches
-        key: ${{ runner.os }}-gradle-solrj-${{ hashFiles('versions.lock') }}
+        key: ${{ runner.os }}-gradle-solrj-${{ hashFiles('**/*.lockfile') }}
         restore-keys: |
           ${{ runner.os }}-gradle-solrj-
           ${{ runner.os }}-gradle-

.github/workflows/tests-via-crave.yml

@@ -11,6 +11,7 @@ jobs:
     name: Run Solr Tests using Crave.io resources
 
     runs-on: self-hosted
+    timeout-minutes: 40
 
     steps:
     - name: Destroy previous clone
@@ -26,5 +27,10 @@ jobs:
       run: |
         cd /crave-devspaces/pipeline/runs/${GITHUB_RUN_ID}_${GITHUB_RUN_NUMBER}
         crave run --clean
-    - name: Delete Clone
-      run: crave clone destroy -y /crave-devspaces/pipeline/runs/${GITHUB_RUN_ID}_${GITHUB_RUN_NUMBER}
+    - name: Cleanup
+      if: ${{ always() }}
+      run: |
+        pushd /crave-devspaces/pipeline/runs/${GITHUB_RUN_ID}_${GITHUB_RUN_NUMBER}
+        crave stop --all
+        popd
+        crave clone destroy -y /crave-devspaces/pipeline/runs/${GITHUB_RUN_ID}_${GITHUB_RUN_NUMBER}

.gitignore

@@ -36,6 +36,9 @@ __pycache__
 gradle/wrapper/gradle-wrapper.jar
 .gradletasknamecache
 
+# Kotlin
+.kotlin/
+
 # WANT TO ADD MORE?  You can tell Git without adding to this file:
 # See https://git-scm.com/docs/gitignore
 # In particular, if you have tools you use, add to $GIT_DIR/info/exclude or use core.excludesFile

NOTICE.txt

@@ -1,6 +1,6 @@
 ==============================================================
  Apache Solr
- Copyright 2006-2024 The Apache Software Foundation
+ Copyright 2006-2025 The Apache Software Foundation
 ==============================================================
 
 This product includes software developed at

build-tools/build-infra/src/main/java/org/apache/lucene/gradle/Checksum.java

@@ -47,7 +47,7 @@
 public class Checksum extends DefaultTask {
   private FileCollection files;
   private File outputDir;
-  private Algorithm algorithm = Checksum.Algorithm.SHA512;
+  private Algorithm algorithm;
 
   public enum Algorithm {
     MD5(new DigestUtils(DigestUtils.getMd5Digest())),
@@ -68,7 +68,7 @@ public String getExtension() {
 
   public Checksum() {
     outputDir = new File(getProject().getBuildDir(), "checksums");
-    algorithm = Algorithm.SHA256;
+    algorithm = Checksum.Algorithm.SHA512;
   }
 
   @InputFiles

build-tools/missing-doclet/src/main/java/org/apache/lucene/missingdoclet/MissingDoclet.java

@@ -438,13 +438,6 @@ private void error(Element element, String message) {
     fullMessage.append("): ");
     fullMessage.append(message);
 
-    if (Runtime.version().feature() == 11 && element.getKind() == ElementKind.PACKAGE) {
-      // Avoid JDK 11 bug:
-      // https://issues.apache.org/jira/browse/LUCENE-9747
-      // https://bugs.openjdk.java.net/browse/JDK-8224082
-      reporter.print(Diagnostic.Kind.ERROR, fullMessage.toString());
-    } else {
-      reporter.print(Diagnostic.Kind.ERROR, element, fullMessage.toString());
-    }
+    reporter.print(Diagnostic.Kind.ERROR, element, fullMessage.toString());
   }
 }

build.gradle

@@ -22,10 +22,10 @@ plugins {
   id 'base'
   id 'solr.build-infra'
 
-  alias(libs.plugins.carrotsearch.dependencychecks)
   alias(libs.plugins.owasp.dependencycheck)
   alias(libs.plugins.cutterslade.analyze)
   alias(libs.plugins.benmanes.versions)
+  alias(libs.plugins.kotlin.multiplatform) apply false
   alias(libs.plugins.littlerobots.versioncatalogupdate) apply false
   alias(libs.plugins.thetaphi.forbiddenapis) apply false
   alias(libs.plugins.undercouch.download) apply false
@@ -39,6 +39,9 @@ plugins {
 rootProject.ext.minJavaVersionDefault = JavaVersion.toVersion(libs.versions.java.min.get())
 rootProject.ext.minJavaVersionSolrJ = JavaVersion.toVersion(libs.versions.java.solrj.get())
 
+// Check development mode for entire project (defaults to true if 'production' not provided and set to true)
+rootProject.ext.development = !project.hasProperty('production') || project.findProperty('production') != 'true'
+
 apply from: file('gradle/globals.gradle')
 
 // General metadata.
@@ -122,18 +125,13 @@ ext {
 apply from: file('gradle/conventions.gradle')
 apply from: file('gradle/generation/local-settings.gradle')
 
-// Ant-compatibility layer: apply folder layout early so that
-// evaluation of other scripts doesn't need to be deferred.
-apply from: file('gradle/ant-compat/solr.folder-layout.gradle')
-
 // Set up defaults and configure aspects for certain modules or functionality
 // (java, tests)
 apply from: file('gradle/java/folder-layout.gradle')
 apply from: file('gradle/java/javac.gradle')
 apply from: file('gradle/testing/defaults-tests.gradle')
 apply from: file('gradle/testing/randomization.gradle')
 apply from: file('gradle/testing/fail-on-no-tests.gradle')
-apply from: file('gradle/testing/fail-on-unsupported-jdk.gradle')
 apply from: file('gradle/testing/alternative-jdk-support.gradle')
 apply from: file('gradle/java/jar-manifest.gradle')
 apply from: file('gradle/testing/retry-test.gradle')
@@ -189,13 +187,6 @@ apply from: file('gradle/help.gradle')
 // Configures development for joint Lucene/ Solr composite build.
 apply from: file('gradle/lucene-dev/lucene-dev-repo-composite.gradle')
 
-// Ant-compatibility layer. ALL OF THESE SHOULD BE GONE at some point. They are
-// here so that we can coexist with current ant build but they are indicative
-// of potential problems with the build conventions, dependencies, etc.
-apply from: file('gradle/ant-compat/misc.gradle')
-
-apply from: file('gradle/ant-compat/artifact-naming.gradle')
-
 apply from: file('gradle/documentation/pull-lucene-javadocs.gradle')
 apply from: file('gradle/documentation/documentation.gradle')
 apply from: file('gradle/documentation/changes-to-html.gradle')
@@ -206,7 +197,6 @@ apply from: file('gradle/hacks/global-exclude-dependencies.gradle')
 apply from: file('gradle/hacks/gradle-archives.gradle')
 
 apply from: file('gradle/hacks/wipe-temp.gradle')
-apply from: file('gradle/hacks/hashmapAssertions.gradle')
 apply from: file('gradle/hacks/turbocharge-jvm-opts.gradle')
 apply from: file('gradle/hacks/dummy-outputs.gradle')
 

dev-docs/FAQ.adoc

@@ -95,7 +95,7 @@ If you don't yet have an account, you have to ask for one in the 'users' or 'dev
 === Where can I find information about test history?
 
 * http://fucit.org/solr-jenkins-reports/failure-report.html
-* https://ge.apache.org/scans/tests?search.relativeStartTime=P90D&search.rootProjectNames=solr*
+* https://develocity.apache.org/scans/tests?search.relativeStartTime=P90D&search.rootProjectNames=solr*
 * https://lists.apache.org[Solr mailing list archives especially builds]
 
 === How can I build the JavaDoc's and the Reference Guide?

dev-docs/dependency-upgrades.adoc

@@ -26,47 +26,46 @@ Read the https://github.com/apache/solr/blob/main/help/dependencies.txt[help/dep
 explanation of how dependencies are managed.
 
 == Manual dependency upgrades
-In order to upgrade a dependency, you need to run through a number of steps:
+To upgrade a dependency, you need to run through a number of steps:
 
 1. Identify the available versions from e.g. https://search.maven.org[Maven Central]
 2. Update the version in `gradle/libs.versions.toml` file
-3. Run `./gradlew writeLocks` to re-generate `versions.lock`. Note that this may cause a cascading effect where
-   the locked version of other dependencies also change.
-4. In case of a conflict, resolve the conflict according to `help/dependencies.txt`
-5. Check if there are any constraints that are obsolete after the dependency update
-6. Update the license and notice files of the changed dependencies. See `help/dependencies.txt` for
-   details.
+3. Run `./gradlew resolveAndLockAll --write-locks` to re-generate lockfiles. Note that this may cause a cascading effect
+   where the locked version of other dependencies also changes.
+4. Run `./gradlew kotlinUpgradeYarnLock` to update the kotlin-js-store lockfile used for the new UI.
+   Most of the cases it will not have any changes.
+5. In case of a conflict, resolve the conflict according to `help/dependencies.txt`
+6. Update the license and notice files of the changed dependencies. See `help/dependencies.txt` for details.
 7. Run `./gradlew updateLicenses` to re-generate SHA1 checksums of the new jar files.
 8. Once in a while, a new version of a dependency will transitively bring in brand-new dependencies.
    You'll need to decide whether to keep or exclude them. See `help/dependencies.txt` for details.
 
-=== Reviewing Constraints
+=== Constraints and Version Alignment
 
-The constraints are defined in gradle/validation/dependencies.gradle. There, if the updated dependency is listed,
-the constraint can be reviewed, updated or removed.
+To sync the version of direct and transitive dependencies across the project, we iterate in the `:platform` module
+over the libraries defined in `gradle/libs.version.toml` and add them as constraints. Then, we use the module in
+main modules like `:solr:api` and `:solr:core` and transitively pass down to all other modules the constraints.
 
-The constraints fall into two "groups". In the first group there are dependency constraints from dependencies
-that our project directly includes and require version alignment to sync the versions across all transitive
-dependencies. In the second group are dependencies that are only present as transitive dependencies.
-There, we try to follow the convention to provide additional information with "which dependencies use what version",
-so that the next person reviewing the constraint does not have to look it up. However, this is quite time-consuming
-to analyze the dependencies and therefore subject to change.
+If a new module does not depend on another module that already includes `:platform` as a platform dependency, it should
+explicitly add it to sync the versions with the rest of the project. `:solr:server` is one case where this is necessary.
 
-In order to review a constraint, you have to check if the updated dependency is mentioned in any of the constraints,
-either as a reason for another dependency constraint or as the constraint's dependency. Removing temporarily
-a constraint, the task writeLocks will fail if the constraint is still required.
+=== Addressing Security Vulnerabilities
 
-This process and the constraints of dependencies.gradle are not optimal, as it is quite time-consuming and not obvious
-by just looking at it. We just haven't found yet a more efficient way to maintain these constraints.
+When it comes to security vulnerabilities that are found in direct or transitive dependencies, the recommended way to
+address them is to update the specific library if there is a new release that solves this issue. For both direct and
+transitive dependencies, we simply have to update the version as described above.
 
-== Renovate bot Pull Requests
+In case it is a transitive dependency that is not directly used, you can simply add it to `libs.versions.toml` as you
+would with any other dependency. The dependency resolution approach defined in `:platform` will handle the rest.
+Don't forget to add a `# @keep` note with a reference to the vulnerable version and CVE that is fixed with the explicit
+definition of the library and new version. This way it is easier to keep track of unreferenced dependencies in our
+libraries toml file, and we can clean them up once the libraries using the modules are updated.
 
-The renovate bot may be replaced in the future with dependabot and this section may only be relevant for older
-versions (<10.0). See https://lists.apache.org/thread/1sb9ttv3lp57z2yod1htx1fykp5sj73z for updates.
+== Renovate bot Pull Requests
 
 A member of the Solr community operates a Github bot running https://github.com/renovatebot/renovate[Renovate], which
 files Pull Requests to Solr with dependency upgrade proposals. The PRs are labeled `dependencies` and do include
-changes resulting from `./gradlew writeLocks` and `updateLicenses`.
+changes resulting from the gradle tasks `resolveAndLockAll` and `updateLicenses`.
 
 Community members and committers can then review, and if manual changes are needed, help bring the PR to completion.
 For many dependencies, a changelog is included in the PR text, which may help guide the upgrade decision.
@@ -78,9 +77,13 @@ that will get its own separate Pull Request, so you can choose.
 If an upgrade is decided, simply merge (and backport) the PR. To skip an upgrade, close the PR. If a PR is left open,
 it will be re-used and auto updated whenever a newer patch- or minor version gets available. Thus, one can reduce
 churn from frequently-updated dependencies by delaying merge until a few weeks before a new release. One can also
-choose to change to a less frequent schedule or disable the bot, by editing `renovate.json`
+choose to change to a less frequent schedule or disable the bot, by editing `renovate.json`.
+
+Please note that Solr version prior to 10.X use a versions resolution plugin that uses `versions.lock` instead of
+`libs.version.toml`. Therefore, changes cannot be backported via cherry-pick.
 
 === Configuring renovate.json
+
 While the bot runs on a https://github.com/solrbot/renovate-github-action[GitHub repo external to the project],
 the bot behavior can be tailored by editing `.github/renovate.json` in this project.
 See https://docs.renovatebot.com[Renovatebot docs] for available options.

dev-docs/lucene-upgrade.md

@@ -27,17 +27,17 @@ Create a new branch locally e.g. `git checkout -b lucene940 -t origin/main` for
 
 ## Build
 
-### `versions.props` update
+### `gradle/libs.versions.toml` update
 
 ```
 - org.apache.lucene:*=9.3.0
 + org.apache.lucene:*=9.4.0
 ```
 
-### `versions.lock` update
+### lockfiles update
 
 ```
-gradlew --write-locks
+gradlew :resolveAndLockAll
 ```
 
 ### `solr/licenses` update