Mailing List Archive

Hi Leith,

Were you able to figure out the security updates available around various
Solr versions? specially for 5.3.1. You can have Basic Auth for Solr 5.x
for sure. Kerberos and PKI and be set-up too.

Amrit Sarkar
Search Engineer
Lucidworks, Inc.
415-589-9269
www.lucidworks.com
Twitter http://twitter.com/lucidworks
LinkedIn: https://www.linkedin.com/in/sarkaramrit2

On Tue, Jan 3, 2017 at 9:09 PM, Tussing, Leith <ltussing@ist.ucf.edu> wrote:

> I've read through the documentation and the email archive and was unable
> to find (or missed) the information I was looking for.
>
> What are the officially supported versions of Solr for security updates?
> We're running 5.3.1 but there hadn't been any updates to 5.x in a couple
> months and I was trying to find the official support/EOL status info to
> present to management to show we're either still actively secure or if we
> needed to expend resources to upgrade from 5.x to 6.x versions.
>
> --Leith
>
>

Hi,

There is no web page listing EOL status. The general rule is that we work on three versions at the same time.
There is the 6.x version which is the “stable” branch where we release new features.
Then there is the 5.5 branch which will most likely receive CVE security updates, but we cannot guarantee other bug fixes.
And finally we work on the next major release 7.x in master branch (never released).

So for you guys on 5.3.1 you have a back-compat upgrade path to released 5.5.3, and should see a 5.5.4 if a really critical issue is found.
There is no EOL date decided for 5.x yet, but once we start talking about releasing 7.x you should prepare to upgrade.

Note: There may also be downstream companies out there offering LTS for older Solr versions, with patches etc.

--
Jan Høydahl, search solution architect
Cominvent AS - www.cominvent.com

> 3. jan. 2017 kl. 16.39 skrev Tussing, Leith <ltussing@ist.ucf.edu>:
>
> I've read through the documentation and the email archive and was unable to find (or missed) the information I was looking for.
>
> What are the officially supported versions of Solr for security updates? We're running 5.3.1 but there hadn't been any updates to 5.x in a couple months and I was trying to find the official support/EOL status info to present to management to show we're either still actively secure or if we needed to expend resources to upgrade from 5.x to 6.x versions.
>
> --Leith
>

Excellent, this is exactly what I needed to know, thank you.

We will plan to upgrade to the latest 5.5.x now while we budget effort to move to the latest 6.x soon.

--Leith

-----Original Message-----
From: Jan Høydahl [mailto:jan.asf@cominvent.com]
Sent: Wednesday, January 11, 2017 5:01 AM
To: general@lucene.apache.org
Subject: Re: Solr supported/EOL versions

Hi,

There is no web page listing EOL status. The general rule is that we work on three versions at the same time.
There is the 6.x version which is the “stable” branch where we release new features.
Then there is the 5.5 branch which will most likely receive CVE security updates, but we cannot guarantee other bug fixes.
And finally we work on the next major release 7.x in master branch (never released).

So for you guys on 5.3.1 you have a back-compat upgrade path to released 5.5.3, and should see a 5.5.4 if a really critical issue is found.
There is no EOL date decided for 5.x yet, but once we start talking about releasing 7.x you should prepare to upgrade.

Note: There may also be downstream companies out there offering LTS for older Solr versions, with patches etc.

--
Jan Høydahl, search solution architect
Cominvent AS - www.cominvent.com

> 3. jan. 2017 kl. 16.39 skrev Tussing, Leith <ltussing@ist.ucf.edu>:
>
> I've read through the documentation and the email archive and was unable to find (or missed) the information I was looking for.
>
> What are the officially supported versions of Solr for security updates? We're running 5.3.1 but there hadn't been any updates to 5.x in a couple months and I was trying to find the official support/EOL status info to present to management to show we're either still actively secure or if we needed to expend resources to upgrade from 5.x to 6.x versions.
>
> --Leith
>

Glad it helped.
I have drafted a new “Support" section on the web page with a similar explanation, please see staging site http://lucene.staging.apache.org/solr/community.html#support <http://lucene.staging.apache.org/solr/community.html#support> and give feedback :)

--
Jan Høydahl, search solution architect
Cominvent AS - www.cominvent.com

> 11. jan. 2017 kl. 15.25 skrev Tussing, Leith <ltussing@ist.ucf.edu>:
>
> Excellent, this is exactly what I needed to know, thank you.
>
> We will plan to upgrade to the latest 5.5.x now while we budget effort to move to the latest 6.x soon.
>
> --Leith
>
> -----Original Message-----
> From: Jan Høydahl [mailto:jan.asf@cominvent.com]
> Sent: Wednesday, January 11, 2017 5:01 AM
> To: general@lucene.apache.org
> Subject: Re: Solr supported/EOL versions
>
> Hi,
>
> There is no web page listing EOL status. The general rule is that we work on three versions at the same time.
> There is the 6.x version which is the “stable” branch where we release new features.
> Then there is the 5.5 branch which will most likely receive CVE security updates, but we cannot guarantee other bug fixes.
> And finally we work on the next major release 7.x in master branch (never released).
>
> So for you guys on 5.3.1 you have a back-compat upgrade path to released 5.5.3, and should see a 5.5.4 if a really critical issue is found.
> There is no EOL date decided for 5.x yet, but once we start talking about releasing 7.x you should prepare to upgrade.
>
> Note: There may also be downstream companies out there offering LTS for older Solr versions, with patches etc.
>
> --
> Jan Høydahl, search solution architect
> Cominvent AS - www.cominvent.com
>
>> 3. jan. 2017 kl. 16.39 skrev Tussing, Leith <ltussing@ist.ucf.edu>:
>>
>> I've read through the documentation and the email archive and was unable to find (or missed) the information I was looking for.
>>
>> What are the officially supported versions of Solr for security updates? We're running 5.3.1 but there hadn't been any updates to 5.x in a couple months and I was trying to find the official support/EOL status info to present to management to show we're either still actively secure or if we needed to expend resources to upgrade from 5.x to 6.x versions.
>>
>> --Leith
>>
>