From 64f0f83d603df0607a782a9ab96319f929bbd92e Mon Sep 17 00:00:00 2001 From: Eric Pugh Date: Thu, 16 Jul 2026 10:20:51 -0300 Subject: [PATCH 1/8] Generate openvex from our cyclonedx inspired vex files. --- plugins/vex/schema/openvex_json_schema.json | 317 ++++++++++++++++++ plugins/vex/vex.py | 155 +++++++++ .../templates/security-dependency-cves.html | 3 +- 3 files changed, 474 insertions(+), 1 deletion(-) create mode 100644 plugins/vex/schema/openvex_json_schema.json diff --git a/plugins/vex/schema/openvex_json_schema.json b/plugins/vex/schema/openvex_json_schema.json new file mode 100644 index 000000000..2a6aecb81 --- /dev/null +++ b/plugins/vex/schema/openvex_json_schema.json @@ -0,0 +1,317 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://github.com/openvex/spec/openvex_json_schema_0.2.0.json", + "title": "OpenVEX", + "description": "OpenVEX is an implementation of the Vulnerability Exploitability Exchange (VEX for short) that is designed to be minimal, compliant, interoperable, and embeddable.", + "type": "object", + "$defs": { + "vulnerability": { + "type": "object", + "properties": { + "@id": { + "type": "string", + "format": "iri", + "description": "An Internationalized Resource Identifier (IRI) identifying the struct." + }, + "name": { + "type": "string", + "description": "A string with the main identifier used to name the vulnerability." + }, + "description": { + "type": "string", + "description": "Optional free form text describing the vulnerability." + }, + "aliases": { + "type": "array", + "uniqueItems": true, + "items": { + "type": "string" + }, + "description": "A list of strings enumerating other names under which the vulnerability may be known." + } + }, + "required": [ + "name" + ], + "additionalProperties": false + }, + "identifiers": { + "type": "object", + "properties": { + "purl": { + "type": "string", + "description": "Package URL" + }, + "cpe22": { + "type": "string", + "description": "Common Platform Enumeration v2.2" + }, + "cpe23": { + "type": "string", + "description": "Common Platform Enumeration v2.3" + } + }, + "additionalProperties": false, + "anyOf": [ + { "required": ["purl"] }, + { "required": ["cpe22"] }, + { "required": ["cpe23"] } + ] + }, + "hashes": { + "type": "object", + "properties": { + "md5": { + "type": "string" + }, + "sha1": { + "type": "string" + }, + "sha-256": { + "type": "string" + }, + "sha-384": { + "type": "string" + }, + "sha-512": { + "type": "string" + }, + "sha3-224": { + "type": "string" + }, + "sha3-256": { + "type": "string" + }, + "sha3-384": { + "type": "string" + }, + "sha3-512": { + "type": "string" + }, + "blake2s-256": { + "type": "string" + }, + "blake2b-256": { + "type": "string" + }, + "blake2b-512": { + "type": "string" + } + }, + "additionalProperties": false + }, + "subcomponent": { + "type": "object", + "properties": { + "@id": { + "type": "string", + "format": "iri", + "description": "Optional IRI identifying the component to make it externally referenceable." + }, + "identifiers": { + "$ref": "#/$defs/identifiers", + "description": "Optional IRI identifying the component to make it externally referenceable." + }, + "hashes": { + "$ref": "#/$defs/hashes", + "description": "Map of cryptographic hashes of the component." + } + }, + "additionalProperties": false, + "anyOf": [ + { "required": ["@id"] }, + { "required": ["identifiers"] } + ] + }, + "component": { + "type": "object", + "properties": { + "@id": { + "type": "string", + "format": "iri", + "description": "Optional IRI identifying the component to make it externally referenceable." + }, + "identifiers": { + "$ref": "#/$defs/identifiers", + "description": "A map of software identifiers where the key is the type and the value the identifier." + }, + "hashes": { + "$ref": "#/$defs/hashes", + "description": "Map of cryptographic hashes of the component." + }, + "subcomponents": { + "type": "array", + "uniqueItems": true, + "description": "List of subcomponent structs describing the subcomponents subject of the VEX statement.", + "items": { + "$ref": "#/$defs/subcomponent" + } + } + }, + "additionalProperties": false, + "anyOf": [ + { "required": ["@id"] }, + { "required": ["identifiers"] } + ] + } + }, + "properties": { + "@context": { + "type": "string", + "format": "uri", + "description": "The URL linking to the OpenVEX context definition." + }, + "@id": { + "type": "string", + "format": "iri", + "description": "The IRI identifying the VEX document." + }, + "author": { + "type": "string", + "description": "Author is the identifier for the author of the VEX statement." + }, + "role": { + "type": "string", + "description": "Role describes the role of the document author." + }, + "timestamp": { + "type": "string", + "format": "date-time", + "description": "Timestamp defines the time at which the document was issued." + }, + "last_updated": { + "type": "string", + "format": "date-time", + "description": "Date of last modification to the document." + }, + "version": { + "type": "integer", + "minimum": 1, + "description": "Version is the document version." + }, + "tooling": { + "type": "string", + "description": "Tooling expresses how the VEX document and contained VEX statements were generated." + }, + "statements": { + "type": "array", + "uniqueItems": true, + "minItems": 1, + "description": "A statement is an assertion made by the document's author about the impact a vulnerability has on one or more software 'products'.", + "items": { + "type": "object", + "properties": { + "@id": { + "type": "string", + "format": "iri", + "description": "Optional IRI identifying the statement to make it externally referenceable." + }, + "version": { + "type": "integer", + "minimum": 1, + "description": "Optional integer representing the statement's version number." + }, + "vulnerability": { + "$ref": "#/$defs/vulnerability", + "description": "A struct identifying the vulnerability." + }, + "timestamp": { + "type": "string", + "format": "date-time", + "description": "Timestamp is the time at which the information expressed in the statement was known to be true." + }, + "last_updated": { + "type": "string", + "format": "date-time", + "description": "Timestamp when the statement was last updated." + }, + "products": { + "type": "array", + "uniqueItems": true, + "description": "List of product structs that the statement applies to.", + "items": { + "$ref": "#/$defs/component" + } + }, + "status": { + "type": "string", + "enum": [ + "not_affected", + "affected", + "fixed", + "under_investigation" + ], + "description": "A VEX statement MUST provide the status of the vulnerabilities with respect to the products and components listed in the statement." + }, + "supplier": { + "type": "string", + "description": "Supplier of the product or subcomponent." + }, + "status_notes": { + "type": "string", + "description": "A statement MAY convey information about how status was determined and MAY reference other VEX information." + }, + "justification": { + "type": "string", + "enum": [ + "component_not_present", + "vulnerable_code_not_present", + "vulnerable_code_not_in_execute_path", + "vulnerable_code_cannot_be_controlled_by_adversary", + "inline_mitigations_already_exist" + ], + "description": "For statements conveying a not_affected status, a VEX statement MUST include either a status justification or an impact_statement informing why the product is not affected by the vulnerability." + }, + "impact_statement": { + "type": "string", + "description": "For statements conveying a not_affected status, a VEX statement MUST include either a status justification or an impact_statement informing why the product is not affected by the vulnerability." + }, + "action_statement": { + "type": "string", + "description": "For a statement with affected status, a VEX statement MUST include a statement that SHOULD describe actions to remediate or mitigate the vulnerability." + }, + "action_statement_timestamp": { + "type": "string", + "format": "date-time", + "description": "The timestamp when the action statement was issued." + } + }, + "required": [ + "vulnerability", + "status" + ], + "additionalProperties": false, + "allOf": [ + { + "if": { + "properties": { "status": { "const": "not_affected" }} + }, + "then": { + "anyOf": [ + { "required": ["justification"]}, + { "required": ["impact_statement"]} + ] + } + }, + { + "if": { + "properties": { "status": { "const": "affected" }} + }, + "then": { + "required": ["action_statement"] + } + } + ] + } + } + }, + "required": [ + "@context", + "@id", + "author", + "timestamp", + "version", + "statements" + ], + "additionalProperties": false +} diff --git a/plugins/vex/vex.py b/plugins/vex/vex.py index e6ed5ebfe..1b2cc217c 100644 --- a/plugins/vex/vex.py +++ b/plugins/vex/vex.py @@ -1,6 +1,7 @@ import glob import json import os +import re from hashlib import md5 from pathlib import Path from uuid import UUID, uuid5 @@ -94,6 +95,8 @@ def read_vex_articles(content_path): 'title': meta.get('title', ''), # Anchor on vex.html (matches each VEX article's slug, see set_vex_slug). 'anchor': vex_anchor(path), + # "YYYY-MM-DD" filename date prefix, used for OpenVEX timestamps. + 'date': os.path.basename(path)[:10], }) return articles @@ -156,6 +159,158 @@ def pelican_init(pelicanobj): with open('%s/solr.vex.json' % output_path, 'w') as out: json.dump(vex, out, indent=2) + # OpenVEX (https://openvex.dev/) output, derived from the same entries and + # validated against the vendored OpenVEX JSON schema. + openvex = build_openvex(vex_input) + with open(SCHEMA_DIR / 'openvex_json_schema.json') as schema: + validate(openvex, json.load(schema)) + with open('%s/solr.openvex.json' % output_path, 'w') as out: + json.dump(openvex, out, indent=2) + + +# --- OpenVEX generation ----------------------------------------------------- + +# CycloneDX analysis.state -> OpenVEX status vocabulary. +OPENVEX_STATUS = { + 'not_affected': 'not_affected', + 'exploitable': 'affected', + 'in_triage': 'under_investigation', + 'resolved': 'fixed', +} + +# CycloneDX analysis.justification -> OpenVEX justification, for the cases that +# have a clean equivalent. 'requires_configuration' has no OpenVEX counterpart, +# so those not_affected statements rely on impact_statement instead. +OPENVEX_JUSTIFICATION = { + 'code_not_present': 'vulnerable_code_not_present', + 'code_not_reachable': 'vulnerable_code_not_in_execute_path', +} + +# Maven groupIds for the artifacts our VEX entries reference, so a JAR name can +# be emitted as a proper purl subcomponent. Artifacts not listed here (or JARs +# whose version can't be parsed, e.g. "guava-*.jar") fall back to a bare @id. +JAR_GROUPS = { + 'opennlp-tools': 'org.apache.opennlp', + 'jetty-http': 'org.eclipse.jetty', + 'jetty-server': 'org.eclipse.jetty', + 'json-path': 'com.jayway.jsonpath', + 'zookeeper': 'org.apache.zookeeper', + 'xercesImpl': 'xerces', + 'protobuf-java': 'com.google.protobuf', + 'commons-beanutils': 'commons-beanutils', + 'commons-configuration2': 'org.apache.commons', + 'commons-text': 'org.apache.commons', + 'dom4j': 'dom4j', + 'avatica-core': 'org.apache.calcite.avatica', + 'calcite': 'org.apache.calcite', + 'slf4j-api': 'org.slf4j', + 'icu4j': 'com.ibm.icu', + 'netty-all': 'io.netty', + 'hadoop-auth': 'org.apache.hadoop', + 'hadoop-common': 'org.apache.hadoop', + 'log4j-core': 'org.apache.logging.log4j', + 'log4j-1.2-api': 'org.apache.logging.log4j', + 'log4j-layout-template-json': 'org.apache.logging.log4j', + 'lucene-analyzers-icu': 'org.apache.lucene', + 'vorbis-java-tika': 'org.gagravarr', + 'velocity-tools': 'org.apache.velocity', + 'org.restlet': 'org.restlet.jee', + 'simple-xml': 'org.simpleframework', + 'carrot2-guava': 'org.carrot2.shaded', + 'junit': 'junit', + 'guava': 'com.google.guava', + 'jackson-databind': 'com.fasterxml.jackson.core', + 'jdom': 'org.jdom', + 'tika-core': 'org.apache.tika', + 'calcite': 'org.apache.calcite', + 'calcite-core': 'org.apache.calcite', + 'jcl-over-slf4j': 'org.slf4j', + 'jul-to-slf4j': 'org.slf4j', + 'hadoop-hdfs': 'org.apache.hadoop', + 'hadoop-client': 'org.apache.hadoop', + 'simple-xml': 'org.simpleframework', +} + +# Split a JAR name into (artifact, version). Standard `artifact-version.jar` uses +# a greedy artifact so the version is the *last* "-" segment (handles +# artifacts that themselves contain version-like parts, e.g. `log4j-1.2-api`). +# The dot-separated form (`tika-core.1.17.jar`) is a rare fallback. +_JAR_HYPHEN_RE = re.compile(r'^(.+)-(\d[\w.]*)\.jar$') +_JAR_DOT_RE = re.compile(r'^(.+?)\.(\d[\w.]*)\.jar$') + + +def jar_to_component(jar): + """Turn a vulnerable-JAR name into an OpenVEX subcomponent: a Maven purl when + the coordinates are known, otherwise a bare @id using the raw name (e.g. for + wildcard or descriptive entries like `guava-*.jar` or `jetty-9.4.6 to 9.4.36`).""" + match = _JAR_HYPHEN_RE.match(jar) or _JAR_DOT_RE.match(jar) + if match: + artifact, version = match.group(1), match.group(2) + group = JAR_GROUPS.get(artifact) + if group: + return {'@id': 'pkg:maven/%s/%s@%s' % (group, artifact, version)} + return {'@id': jar} + + +def build_openvex(entries): + """Build an OpenVEX (v0.2.0) document from read_vex_articles() entries. + + The affected product is Apache Solr (a version-less purl, since OpenVEX has + no version-range syntax); the vulnerable JARs become subcomponent purls, and + our free-text affected-version range is preserved in status_notes. + """ + statements = [] + for v in entries: + if not v['ids']: + continue + status = OPENVEX_STATUS.get(v['analysis']['state'], 'under_investigation') + detail = (v['analysis'].get('detail') or '').strip() + + vulnerability = {'name': v['ids'][0]} + if len(v['ids']) > 1: + vulnerability['aliases'] = v['ids'][1:] + + product = {'@id': 'pkg:maven/org.apache.solr/solr-core'} + if v['jars']: + product['subcomponents'] = [jar_to_component(j) for j in v['jars']] + + statement = { + 'vulnerability': vulnerability, + 'products': [product], + 'status': status, + 'timestamp': '%sT00:00:00Z' % v['date'], + } + notes = ('Affected Apache Solr versions: %s.' % v['versions']) if v['versions'] else '' + + if status == 'not_affected': + justification = OPENVEX_JUSTIFICATION.get(v['analysis'].get('justification')) + if justification: + statement['justification'] = justification + # OpenVEX requires a justification or impact_statement for not_affected. + statement['impact_statement'] = detail or 'Apache Solr is not affected.' + if notes: + statement['status_notes'] = notes + elif status == 'affected': + statement['action_statement'] = detail or 'Update to a fixed release of Apache Solr.' + if notes: + statement['status_notes'] = notes + else: # under_investigation / fixed + combined = ' '.join(part for part in (notes, detail) if part) + if combined: + statement['status_notes'] = combined + + statements.append(statement) + + newest = max((v['date'] for v in entries), default='1970-01-01') + return { + '@context': 'https://openvex.dev/ns/v0.2.0', + '@id': 'https://solr.apache.org/solr.openvex.json', + 'author': 'Apache Solr Project (security@apache.org)', + 'timestamp': '%sT00:00:00Z' % newest, + 'version': 1, + 'statements': statements, + } + def generator_initialized(generator): # The dependency-CVE table (security-dependency-cves.html) lists the entries diff --git a/themes/solr/templates/security-dependency-cves.html b/themes/solr/templates/security-dependency-cves.html index 1c9436d50..02d0635c8 100644 --- a/themes/solr/templates/security-dependency-cves.html +++ b/themes/solr/templates/security-dependency-cves.html @@ -12,7 +12,8 @@

CVE Status for Dependencies - ⬇ Download Solr VEX File (JSON) + ⬇ Download Solr VEX File (CycloneDX JSON) + ⬇ Download Solr VEX File (OpenVEX JSON)

CVE Status for Dependencies

From a463d3b25801d0476fd31a0405052c759dc24415 Mon Sep 17 00:00:00 2001 From: Eric Pugh Date: Thu, 16 Jul 2026 10:48:47 -0300 Subject: [PATCH 2/8] List out each version of Solr that a VEX statement applies to. Only works with lower bounded statements. --- plugins/vex/solr-versions.txt | 127 ++++++++++++++++++++++++++++++++++ plugins/vex/vex.py | 98 ++++++++++++++++++++++++-- 2 files changed, 218 insertions(+), 7 deletions(-) create mode 100644 plugins/vex/solr-versions.txt diff --git a/plugins/vex/solr-versions.txt b/plugins/vex/solr-versions.txt new file mode 100644 index 000000000..9b1f0df51 --- /dev/null +++ b/plugins/vex/solr-versions.txt @@ -0,0 +1,127 @@ +# Authoritative list of released Apache Solr versions, one per line. +# +# Used by the vex plugin (plugins/vex/vex.py, expand_versions) to expand the +# free-form `versions` ranges in content/solr/vex/*.md into concrete per-version +# purls in solr.openvex.json. +# +# Regenerate from a Solr checkout's git tags, e.g.: +# git -C ../solr tag | grep -E 'releases/(solr|lucene-solr)/[0-9]' \ +# | sed -E 's#.*/##' | grep -viE 'alpha|beta|rc' | sort -V -u +1.1.0 +1.2.0 +1.3.0 +1.4.0 +3.1 +3.2 +3.3 +3.4.0 +3.5.0 +3.6.0 +3.6.1 +3.6.2 +4.0.0 +4.1.0 +4.2.0 +4.2.1 +4.3.0 +4.3.1 +4.4.0 +4.5.0 +4.5.1 +4.6.0 +4.6.1 +4.7.0 +4.7.1 +4.7.2 +4.8.0 +4.8.1 +4.9.0 +4.9.1 +4.10.0 +4.10.1 +4.10.2 +4.10.3 +4.10.4 +5.0.0 +5.1.0 +5.2.0 +5.2.1 +5.3.0 +5.3.1 +5.3.2 +5.4.0 +5.4.1 +5.5.0 +5.5.1 +5.5.2 +5.5.3 +5.5.4 +5.5.5 +6.0.0 +6.0.1 +6.1.0 +6.2.0 +6.2.1 +6.3.0 +6.4.0 +6.4.1 +6.4.2 +6.5.0 +6.5.1 +6.6.0 +6.6.1 +6.6.2 +6.6.3 +6.6.4 +6.6.5 +6.6.6 +7.0.0 +7.0.1 +7.1.0 +7.2.0 +7.2.1 +7.3.0 +7.3.1 +7.4.0 +7.5.0 +7.6.0 +7.7.0 +7.7.1 +7.7.2 +7.7.3 +8.0.0 +8.1.0 +8.1.1 +8.2.0 +8.3.0 +8.3.1 +8.4.0 +8.4.1 +8.5.0 +8.5.1 +8.5.2 +8.6.0 +8.6.1 +8.6.2 +8.6.3 +8.7.0 +8.8.0 +8.8.1 +9.0.0 +9.1.0 +9.1.1 +9.2.0 +9.2.1 +9.3.0 +9.4.0 +9.4.1 +9.5.0 +9.6.0 +9.6.1 +9.7.0 +9.8.0 +9.8.1 +9.9.0 +9.10.0 +9.10.1 +10.0.0 diff --git a/plugins/vex/vex.py b/plugins/vex/vex.py index 1b2cc217c..28134b7f9 100644 --- a/plugins/vex/vex.py +++ b/plugins/vex/vex.py @@ -252,12 +252,85 @@ def jar_to_component(jar): return {'@id': jar} +# Authoritative list of every released Solr version, used to expand the +# free-form `versions` ranges into concrete per-version purls for OpenVEX. +VERSIONS_FILE = Path(__file__).resolve().parent / 'solr-versions.txt' +_solr_versions = None +_INF = 10 ** 9 + + +def solr_versions(): + global _solr_versions + if _solr_versions is None: + _solr_versions = [ + ln.strip() + for ln in VERSIONS_FILE.read_text().splitlines() + if ln.strip() and not ln.strip().startswith('#') + ] + return _solr_versions + + +def _vkey(version): + """Concrete version string -> comparable 4-tuple (missing parts default to 0).""" + parts = [int(re.match(r'\d+', p).group()) for p in version.split('.') if re.match(r'\d+', p)] + return tuple((parts + [0, 0, 0, 0])[:4]) + + +def _token_bounds(token): + """A version token -> (low, high) inclusive keys it covers. Fewer components + or a trailing '.x' widen it to the whole line: '9.9.0' is exact, '9.10' is the + 9.10.x line, '8.x' is the whole 8.x major line.""" + token = token.strip() + wildcard = token.endswith('.x') + core = token[:-2] if wildcard else token + parts = [int(re.match(r'\d+', p).group()) for p in core.split('.') if re.match(r'\d+', p)] + low = tuple((parts + [0, 0, 0, 0])[:4]) + if not wildcard and len(parts) >= 3: # fully-specified version -> exact + return low, low + return low, tuple((parts + [_INF, _INF, _INF, _INF])[:4]) + + +def _matches_token(vk, tok): + tok = tok.strip() + if tok.startswith('≤') or tok.startswith('<='): + return vk <= _token_bounds(tok.lstrip('≤<= ').strip())[1] + if tok.startswith('<'): + return vk < _token_bounds(tok.lstrip('< ').strip())[0] + if tok.startswith('≥') or tok.startswith('>='): + return vk >= _token_bounds(tok.lstrip('≥>= ').strip())[0] + if '-' in tok: + a, b = tok.split('-', 1) + return _token_bounds(a)[0] <= vk <= _token_bounds(b)[1] + low, high = _token_bounds(tok) + return low <= vk <= high + + +def expand_versions(range_str): + """Expand a `versions` range string (e.g. '4.6.0-8.x') into the concrete + released Solr versions it covers. + + Only fully-closed ranges are expanded. Ranges with an open lower bound + ('≤'/'<'), and 'all'/empty ranges, return [] so the caller falls back to a + version-less product purl. Without a real lower bound, expansion would run + back to the earliest release (1.1.0) and over-claim versions that predate the + affected dependency. (Closing those bounds is a follow-up in the VEX data.)""" + if not range_str or range_str.strip() == 'all': + return [] + tokens = range_str.split(',') + if any(t.strip().startswith(('≤', '<')) for t in tokens): + return [] + return [v for v in solr_versions() if any(_matches_token(_vkey(v), t) for t in tokens)] + + def build_openvex(entries): """Build an OpenVEX (v0.2.0) document from read_vex_articles() entries. - The affected product is Apache Solr (a version-less purl, since OpenVEX has - no version-range syntax); the vulnerable JARs become subcomponent purls, and - our free-text affected-version range is preserved in status_notes. + Each entry's free-form `versions` range is expanded (via solr-versions.txt) + into one versioned Solr product purl per affected release, so scanners can + match on version; the vulnerable JARs become subcomponent purls. Entries with + an open lower bound ('≤'/'<'), or 'all'/empty ranges, fall back to a single + version-less product to avoid over-claiming ancient releases (see + expand_versions). """ statements = [] for v in entries: @@ -270,13 +343,24 @@ def build_openvex(entries): if len(v['ids']) > 1: vulnerability['aliases'] = v['ids'][1:] - product = {'@id': 'pkg:maven/org.apache.solr/solr-core'} - if v['jars']: - product['subcomponents'] = [jar_to_component(j) for j in v['jars']] + subcomponents = [jar_to_component(j) for j in v['jars']] + affected = expand_versions(v['versions']) + if affected: + products = [] + for ver in affected: + product = {'@id': 'pkg:maven/org.apache.solr/solr-core@%s' % ver} + if subcomponents: + product['subcomponents'] = subcomponents + products.append(product) + else: + product = {'@id': 'pkg:maven/org.apache.solr/solr-core'} + if subcomponents: + product['subcomponents'] = subcomponents + products = [product] statement = { 'vulnerability': vulnerability, - 'products': [product], + 'products': products, 'status': status, 'timestamp': '%sT00:00:00Z' % v['date'], } From d8b2ecc3fbfd0068627f4d797c554e9499ba0cf1 Mon Sep 17 00:00:00 2001 From: Eric Pugh Date: Sat, 18 Jul 2026 07:32:52 -0300 Subject: [PATCH 3/8] Openvex file being generated, though with hardcoded mappings. --- plugins/vex/solr-dependency-versions.json | 2978 +++++++++++++++++++++ plugins/vex/vex.py | 97 +- 2 files changed, 3055 insertions(+), 20 deletions(-) create mode 100644 plugins/vex/solr-dependency-versions.json diff --git a/plugins/vex/solr-dependency-versions.json b/plugins/vex/solr-dependency-versions.json new file mode 100644 index 000000000..67770cab4 --- /dev/null +++ b/plugins/vex/solr-dependency-versions.json @@ -0,0 +1,2978 @@ +{ + "com.fasterxml.jackson.core:jackson-databind": { + "10.0.0": "2.20.0", + "4.10.0": "2.3.1", + "4.10.1": "2.3.1", + "4.10.2": "2.3.1", + "4.10.3": "2.3.1", + "4.10.4": "2.3.1", + "4.7.0": "2.3.1", + "4.7.1": "2.3.1", + "4.7.2": "2.3.1", + "4.8.0": "2.3.1", + "4.8.1": "2.3.1", + "4.9.0": "2.3.1", + "4.9.1": "2.3.1", + "5.0.0": "2.3.1", + "5.1.0": "2.3.1", + "5.2.0": "2.3.1", + "5.2.1": "2.3.1", + "5.3.0": "2.5.4", + "5.3.1": "2.5.4", + "5.3.2": "2.5.4", + "5.4.0": "2.5.4", + "5.4.1": "2.5.4", + "5.5.0": "2.5.4", + "5.5.1": "2.5.4", + "5.5.2": "2.5.4", + "5.5.3": "2.5.4", + "5.5.4": "2.5.4", + "5.5.5": "2.5.4", + "6.0.0": "2.5.4", + "6.0.1": "2.5.4", + "6.1.0": "2.5.4", + "6.2.0": "2.5.4", + "6.2.1": "2.5.4", + "6.3.0": "2.5.4", + "6.4.0": "2.5.4", + "6.4.1": "2.5.4", + "6.4.2": "2.5.4", + "6.5.0": "2.5.4", + "6.5.1": "2.5.4", + "6.6.0": "2.5.4", + "6.6.1": "2.5.4", + "6.6.2": "2.5.4", + "6.6.3": "2.5.4", + "6.6.4": "2.5.4", + "6.6.5": "2.5.4", + "6.6.6": "2.5.4", + "7.0.0": "2.5.4", + "7.0.1": "2.5.4", + "7.1.0": "2.5.4", + "7.2.0": "2.5.4", + "7.2.1": "2.5.4", + "7.3.0": "2.5.4", + "7.3.1": "2.5.4", + "7.4.0": "2.9.5", + "7.5.0": "2.9.5", + "7.6.0": "2.9.6", + "7.7.0": "2.9.6", + "7.7.1": "2.9.6", + "7.7.2": "2.9.8", + "7.7.3": "2.9.8", + "8.0.0": "2.9.6", + "8.1.0": "2.9.8", + "8.1.1": "2.9.8", + "8.2.0": "2.9.8", + "8.3.0": "2.9.9.3", + "8.3.1": "2.9.9.3", + "8.4.0": "2.10.0", + "8.4.1": "2.10.0", + "8.5.0": "2.10.1", + "8.5.1": "2.10.1", + "8.5.2": "2.10.1", + "8.6.0": "2.10.1", + "8.6.1": "2.10.1", + "8.6.2": "2.10.1", + "8.6.3": "2.10.1", + "8.7.0": "2.11.2", + "8.8.0": "2.11.2", + "8.8.1": "2.11.2", + "9.0.0": "2.13.2.2", + "9.1.0": "2.13.3", + "9.1.1": "2.13.4.2", + "9.10.0": "2.18.0", + "9.10.1": "2.18.0", + "9.2.0": "2.14.2", + "9.2.1": "2.14.2", + "9.3.0": "2.15.2", + "9.4.0": "2.15.2", + "9.4.1": "2.16.1", + "9.5.0": "2.16.1", + "9.6.0": "2.16.1", + "9.6.1": "2.16.1", + "9.7.0": "2.17.2", + "9.8.0": "2.18.0", + "9.8.1": "2.18.0", + "9.9.0": "2.18.0" + }, + "com.google.guava:guava": { + "10.0.0": "33.4.8-jre", + "4.1.0": "13.0.1", + "4.10.0": "14.0.1", + "4.10.1": "14.0.1", + "4.10.2": "14.0.1", + "4.10.3": "14.0.1", + "4.10.4": "14.0.1", + "4.2.0": "13.0.1", + "4.2.1": "13.0.1", + "4.3.0": "13.0.1", + "4.3.1": "13.0.1", + "4.4.0": "14.0.1", + "4.5.0": "14.0.1", + "4.5.1": "14.0.1", + "4.6.0": "14.0.1", + "4.6.1": "14.0.1", + "4.7.0": "14.0.1", + "4.7.1": "14.0.1", + "4.7.2": "14.0.1", + "4.8.0": "14.0.1", + "4.8.1": "14.0.1", + "4.9.0": "14.0.1", + "4.9.1": "14.0.1", + "5.0.0": "14.0.1", + "5.1.0": "14.0.1", + "5.2.0": "14.0.1", + "5.2.1": "14.0.1", + "5.3.0": "14.0.1", + "5.3.1": "14.0.1", + "5.3.2": "14.0.1", + "5.4.0": "14.0.1", + "5.4.1": "14.0.1", + "5.5.0": "14.0.1", + "5.5.1": "14.0.1", + "5.5.2": "14.0.1", + "5.5.3": "14.0.1", + "5.5.4": "14.0.1", + "5.5.5": "14.0.1", + "6.0.0": "14.0.1", + "6.0.1": "14.0.1", + "6.1.0": "14.0.1", + "6.2.0": "14.0.1", + "6.2.1": "14.0.1", + "6.3.0": "14.0.1", + "6.4.0": "14.0.1", + "6.4.1": "14.0.1", + "6.4.2": "14.0.1", + "6.5.0": "14.0.1", + "6.5.1": "14.0.1", + "6.6.0": "14.0.1", + "6.6.1": "14.0.1", + "6.6.2": "14.0.1", + "6.6.3": "14.0.1", + "6.6.4": "14.0.1", + "6.6.5": "14.0.1", + "6.6.6": "14.0.1", + "7.0.0": "14.0.1", + "7.0.1": "14.0.1", + "7.1.0": "14.0.1", + "7.2.0": "14.0.1", + "7.2.1": "14.0.1", + "7.3.0": "14.0.1", + "7.3.1": "14.0.1", + "7.4.0": "14.0.1", + "7.5.0": "14.0.1", + "7.6.0": "14.0.1", + "7.7.0": "14.0.1", + "7.7.1": "14.0.1", + "7.7.2": "14.0.1", + "7.7.3": "14.0.1", + "8.0.0": "14.0.1", + "8.1.0": "25.1-jre", + "8.1.1": "25.1-jre", + "8.2.0": "25.1-jre", + "8.3.0": "25.1-jre", + "8.3.1": "25.1-jre", + "8.4.0": "25.1-jre", + "8.4.1": "25.1-jre", + "8.5.0": "25.1-jre", + "8.5.1": "25.1-jre", + "8.5.2": "25.1-jre", + "8.6.0": "25.1-jre", + "8.6.1": "25.1-jre", + "8.6.2": "25.1-jre", + "8.6.3": "25.1-jre", + "8.7.0": "25.1-jre", + "8.8.0": "25.1-jre", + "8.8.1": "25.1-jre", + "9.0.0": "31.0.1-jre", + "9.1.0": "31.1-jre", + "9.1.1": "31.1-jre", + "9.10.0": "33.1.0-jre", + "9.10.1": "33.1.0-jre", + "9.2.0": "31.1-jre", + "9.2.1": "31.1-jre", + "9.3.0": "32.0.1-jre", + "9.4.0": "32.1.2-jre", + "9.4.1": "32.1.3-jre", + "9.5.0": "32.1.3-jre", + "9.6.0": "32.1.3-jre", + "9.6.1": "32.1.3-jre", + "9.7.0": "33.1.0-jre", + "9.8.0": "33.1.0-jre", + "9.8.1": "33.1.0-jre", + "9.9.0": "33.1.0-jre" + }, + "com.google.protobuf:protobuf-java": { + "10.0.0": "3.25.8", + "4.10.0": "2.5.0", + "4.10.1": "2.5.0", + "4.10.2": "2.5.0", + "4.10.3": "2.5.0", + "4.10.4": "2.5.0", + "4.4.0": "2.4.0a", + "4.5.0": "2.4.0a", + "4.5.1": "2.4.0a", + "4.6.0": "2.5.0", + "4.6.1": "2.5.0", + "4.7.0": "2.5.0", + "4.7.1": "2.5.0", + "4.7.2": "2.5.0", + "4.8.0": "2.5.0", + "4.8.1": "2.5.0", + "4.9.0": "2.5.0", + "4.9.1": "2.5.0", + "5.0.0": "2.5.0", + "5.1.0": "2.5.0", + "5.2.0": "2.5.0", + "5.2.1": "2.5.0", + "5.3.0": "2.5.0", + "5.3.1": "2.5.0", + "5.3.2": "2.5.0", + "5.4.0": "2.5.0", + "5.4.1": "2.5.0", + "5.5.0": "2.5.0", + "5.5.1": "2.5.0", + "5.5.2": "2.5.0", + "5.5.3": "2.5.0", + "5.5.4": "2.5.0", + "5.5.5": "2.5.0", + "6.0.0": "2.5.0", + "6.0.1": "2.5.0", + "6.1.0": "2.5.0", + "6.2.0": "2.5.0", + "6.2.1": "2.5.0", + "6.3.0": "2.5.0", + "6.4.0": "2.5.0", + "6.4.1": "2.5.0", + "6.4.2": "2.5.0", + "6.5.0": "3.1.0", + "6.5.1": "3.1.0", + "6.6.0": "3.1.0", + "6.6.1": "3.1.0", + "6.6.2": "3.1.0", + "6.6.3": "3.1.0", + "6.6.4": "3.1.0", + "6.6.5": "3.1.0", + "6.6.6": "3.1.0", + "7.0.0": "3.1.0", + "7.0.1": "3.1.0", + "7.1.0": "3.1.0", + "7.2.0": "3.1.0", + "7.2.1": "3.1.0", + "7.3.0": "3.1.0", + "7.3.1": "3.1.0", + "7.4.0": "3.1.0", + "7.5.0": "3.1.0", + "7.6.0": "3.1.0", + "7.7.0": "3.1.0", + "7.7.1": "3.1.0", + "7.7.2": "3.1.0", + "7.7.3": "3.1.0", + "8.0.0": "3.6.1", + "8.1.0": "3.6.1", + "8.1.1": "3.6.1", + "8.2.0": "3.6.1", + "8.3.0": "3.6.1", + "8.3.1": "3.6.1", + "8.4.0": "3.6.1", + "8.4.1": "3.6.1", + "8.5.0": "3.11.0", + "8.5.1": "3.11.0", + "8.5.2": "3.11.0", + "8.6.0": "3.11.0", + "8.6.1": "3.11.0", + "8.6.2": "3.11.0", + "8.6.3": "3.11.0", + "8.7.0": "3.11.0", + "8.8.0": "3.11.0", + "8.8.1": "3.11.0", + "9.0.0": "3.19.4", + "9.1.0": "3.21.4", + "9.1.1": "3.21.12", + "9.10.0": "3.25.8", + "9.10.1": "3.25.8", + "9.2.0": "3.21.12", + "9.2.1": "3.21.12", + "9.3.0": "3.23.1", + "9.4.0": "3.23.1", + "9.4.1": "3.24.0", + "9.5.0": "3.24.0", + "9.6.0": "3.25.1", + "9.6.1": "3.25.1", + "9.7.0": "3.25.3", + "9.8.0": "3.25.3", + "9.8.1": "3.25.3", + "9.9.0": "3.25.3" + }, + "com.ibm.icu:icu4j": { + "10.0.0": "77.1", + "3.6.0": "4.8.1.1", + "3.6.1": "4.8.1.1", + "3.6.2": "4.8.1.1", + "4.0.0": "49.1", + "4.1.0": "49.1", + "4.10.0": "53.1", + "4.10.1": "53.1", + "4.10.2": "53.1", + "4.10.3": "53.1", + "4.10.4": "53.1", + "4.2.0": "49.1", + "4.2.1": "49.1", + "4.3.0": "49.1", + "4.3.1": "49.1", + "4.4.0": "49.1", + "4.5.0": "49.1", + "4.5.1": "49.1", + "4.6.0": "49.1", + "4.6.1": "49.1", + "4.7.0": "52.1", + "4.7.1": "52.1", + "4.7.2": "52.1", + "4.8.0": "52.1", + "4.8.1": "53.1", + "4.9.0": "53.1", + "4.9.1": "53.1", + "5.0.0": "54.1", + "5.1.0": "54.1", + "5.2.0": "54.1", + "5.2.1": "54.1", + "5.3.0": "54.1", + "5.3.1": "54.1", + "5.3.2": "54.1", + "5.4.0": "54.1", + "5.4.1": "54.1", + "5.5.0": "54.1", + "5.5.1": "54.1", + "5.5.2": "54.1", + "5.5.3": "54.1", + "5.5.4": "54.1", + "5.5.5": "54.1", + "6.0.0": "56.1", + "6.0.1": "56.1", + "6.1.0": "56.1", + "6.2.0": "56.1", + "6.2.1": "56.1", + "6.3.0": "56.1", + "6.4.0": "56.1", + "6.4.1": "56.1", + "6.4.2": "56.1", + "6.5.0": "56.1", + "6.5.1": "56.1", + "6.6.0": "56.1", + "6.6.1": "56.1", + "6.6.2": "56.1", + "6.6.3": "56.1", + "6.6.4": "56.1", + "6.6.5": "56.1", + "6.6.6": "56.1", + "7.0.0": "59.1", + "7.0.1": "59.1", + "7.1.0": "59.1", + "7.2.0": "59.1", + "7.2.1": "59.1", + "7.3.0": "59.1", + "7.3.1": "59.1", + "7.4.0": "61.1", + "7.5.0": "62.1", + "7.6.0": "62.1", + "7.7.0": "62.1", + "7.7.1": "62.1", + "7.7.2": "62.1", + "7.7.3": "62.1", + "8.0.0": "62.1", + "8.1.0": "62.1", + "8.1.1": "62.1", + "8.2.0": "62.1", + "8.3.0": "62.1", + "8.3.1": "62.1", + "8.4.0": "62.1", + "8.4.1": "62.1", + "8.5.0": "62.1", + "8.5.1": "62.1", + "8.5.2": "62.1", + "8.6.0": "62.1", + "8.6.1": "62.1", + "8.6.2": "62.1", + "8.6.3": "62.1", + "8.7.0": "62.1", + "8.8.0": "62.1", + "8.8.1": "62.1", + "9.0.0": "68.2", + "9.1.0": "70.1", + "9.1.1": "70.1", + "9.10.0": "74.2", + "9.10.1": "74.2", + "9.2.0": "70.1", + "9.2.1": "70.1", + "9.3.0": "70.1", + "9.4.0": "70.1", + "9.4.1": "70.1", + "9.5.0": "70.1", + "9.6.0": "70.1", + "9.6.1": "70.1", + "9.7.0": "74.2", + "9.8.0": "74.2", + "9.8.1": "74.2", + "9.9.0": "74.2" + }, + "com.jayway.jsonpath:json-path": { + "10.0.0": "2.9.0", + "8.1.0": "2.4.0", + "8.1.1": "2.4.0", + "8.2.0": "2.4.0", + "8.3.0": "2.4.0", + "8.3.1": "2.4.0", + "8.4.0": "2.4.0", + "8.4.1": "2.4.0", + "8.5.0": "2.4.0", + "8.5.1": "2.4.0", + "8.5.2": "2.4.0", + "8.6.0": "2.4.0", + "8.6.1": "2.4.0", + "8.6.2": "2.4.0", + "8.6.3": "2.4.0", + "8.7.0": "2.4.0", + "8.8.0": "2.4.0", + "8.8.1": "2.4.0", + "9.0.0": "2.4.0", + "9.1.0": "2.7.0", + "9.1.1": "2.7.0", + "9.10.0": "2.9.0", + "9.10.1": "2.9.0", + "9.2.0": "2.7.0", + "9.2.1": "2.7.0", + "9.3.0": "2.8.0", + "9.4.0": "2.8.0", + "9.4.1": "2.8.0", + "9.5.0": "2.8.0", + "9.6.0": "2.9.0", + "9.6.1": "2.9.0", + "9.7.0": "2.9.0", + "9.8.0": "2.9.0", + "9.8.1": "2.9.0", + "9.9.0": "2.9.0" + }, + "commons-beanutils:commons-beanutils": { + "10.0.0": "1.9.4", + "3.6.0": "1.7.0", + "3.6.1": "1.7.0", + "3.6.2": "1.7.0", + "4.0.0": "1.7.0", + "4.1.0": "1.7.0", + "4.10.0": "1.8.3", + "4.10.1": "1.8.3", + "4.10.2": "1.8.3", + "4.10.3": "1.8.3", + "4.10.4": "1.8.3", + "4.2.0": "1.7.0", + "4.2.1": "1.7.0", + "4.3.0": "1.7.0", + "4.3.1": "1.7.0", + "4.4.0": "1.7.0", + "4.5.0": "1.7.0", + "4.5.1": "1.7.0", + "4.6.0": "1.7.0", + "4.6.1": "1.7.0", + "4.7.0": "1.7.0", + "4.7.1": "1.7.0", + "4.7.2": "1.7.0", + "4.8.0": "1.7.0", + "4.8.1": "1.7.0", + "4.9.0": "1.8.3", + "4.9.1": "1.8.3", + "5.0.0": "1.8.3", + "5.1.0": "1.8.3", + "5.2.0": "1.8.3", + "5.2.1": "1.8.3", + "5.3.0": "1.8.3", + "5.3.1": "1.8.3", + "5.3.2": "1.8.3", + "5.4.0": "1.8.3", + "5.4.1": "1.8.3", + "5.5.0": "1.8.3", + "5.5.1": "1.8.3", + "5.5.2": "1.8.3", + "5.5.3": "1.8.3", + "5.5.4": "1.8.3", + "5.5.5": "1.8.3", + "6.0.0": "1.8.3", + "6.0.1": "1.8.3", + "6.1.0": "1.8.3", + "6.2.0": "1.8.3", + "6.2.1": "1.8.3", + "6.3.0": "1.8.3", + "6.4.0": "1.8.3", + "6.4.1": "1.8.3", + "6.4.2": "1.8.3", + "6.5.0": "1.8.3", + "6.5.1": "1.8.3", + "6.6.0": "1.8.3", + "6.6.1": "1.8.3", + "6.6.2": "1.8.3", + "6.6.3": "1.8.3", + "6.6.4": "1.8.3", + "6.6.5": "1.8.3", + "6.6.6": "1.8.3", + "7.0.0": "1.8.3", + "7.0.1": "1.8.3", + "7.1.0": "1.8.3", + "7.2.0": "1.8.3", + "7.2.1": "1.8.3", + "7.3.0": "1.8.3", + "7.3.1": "1.8.3", + "7.4.0": "1.8.3", + "8.0.0": "1.9.3", + "8.1.0": "1.9.3", + "8.1.1": "1.9.3", + "8.2.0": "1.9.3", + "9.10.0": "1.9.4", + "9.10.1": "1.9.4", + "9.8.0": "1.9.4", + "9.8.1": "1.9.4", + "9.9.0": "1.9.4" + }, + "dom4j:dom4j": { + "3.6.0": "1.6.1", + "3.6.1": "1.6.1", + "3.6.2": "1.6.1", + "4.0.0": "1.6.1", + "4.1.0": "1.6.1", + "4.10.0": "1.6.1", + "4.10.1": "1.6.1", + "4.10.2": "1.6.1", + "4.10.3": "1.6.1", + "4.10.4": "1.6.1", + "4.2.0": "1.6.1", + "4.2.1": "1.6.1", + "4.3.0": "1.6.1", + "4.3.1": "1.6.1", + "4.4.0": "1.6.1", + "4.5.0": "1.6.1", + "4.5.1": "1.6.1", + "4.6.0": "1.6.1", + "4.6.1": "1.6.1", + "4.7.0": "1.6.1", + "4.7.1": "1.6.1", + "4.7.2": "1.6.1", + "4.8.0": "1.6.1", + "4.8.1": "1.6.1", + "4.9.0": "1.6.1", + "4.9.1": "1.6.1", + "5.0.0": "1.6.1", + "5.1.0": "1.6.1", + "5.2.0": "1.6.1", + "5.2.1": "1.6.1", + "5.3.0": "1.6.1", + "5.3.1": "1.6.1", + "5.3.2": "1.6.1", + "5.4.0": "1.6.1", + "5.4.1": "1.6.1", + "5.5.0": "1.6.1", + "5.5.1": "1.6.1", + "5.5.2": "1.6.1", + "5.5.3": "1.6.1", + "5.5.4": "1.6.1", + "5.5.5": "1.6.1", + "6.0.0": "1.6.1", + "6.0.1": "1.6.1", + "6.1.0": "1.6.1", + "6.2.0": "1.6.1", + "6.2.1": "1.6.1", + "6.3.0": "1.6.1", + "6.4.0": "1.6.1", + "6.4.1": "1.6.1", + "6.4.2": "1.6.1", + "6.5.0": "1.6.1", + "6.5.1": "1.6.1", + "6.6.0": "1.6.1", + "6.6.1": "1.6.1", + "6.6.2": "1.6.1", + "6.6.3": "1.6.1", + "6.6.4": "1.6.1", + "6.6.5": "1.6.1", + "6.6.6": "1.6.1", + "7.0.0": "1.6.1", + "7.0.1": "1.6.1", + "7.1.0": "1.6.1", + "7.2.0": "1.6.1", + "7.2.1": "1.6.1", + "7.3.0": "1.6.1", + "7.3.1": "1.6.1", + "7.4.0": "1.6.1", + "7.5.0": "1.6.1", + "7.6.0": "1.6.1", + "7.7.0": "1.6.1", + "7.7.1": "1.6.1", + "7.7.2": "1.6.1", + "7.7.3": "1.6.1", + "8.0.0": "1.6.1" + }, + "io.netty:netty-all": { + "6.2.0": "4.0.36.Final", + "6.2.1": "4.0.36.Final", + "6.3.0": "4.0.36.Final", + "6.4.0": "4.0.36.Final", + "6.4.1": "4.0.36.Final", + "6.4.2": "4.0.36.Final", + "6.5.0": "4.0.36.Final", + "6.5.1": "4.0.36.Final", + "6.6.0": "4.0.36.Final", + "6.6.1": "4.0.36.Final", + "6.6.2": "4.0.36.Final", + "6.6.3": "4.0.36.Final", + "6.6.4": "4.0.36.Final", + "6.6.5": "4.0.36.Final", + "6.6.6": "4.0.36.Final", + "7.0.0": "4.0.36.Final", + "7.0.1": "4.0.36.Final", + "7.1.0": "4.0.36.Final", + "7.2.0": "4.0.36.Final", + "7.2.1": "4.0.36.Final", + "7.3.0": "4.0.36.Final", + "7.3.1": "4.0.36.Final", + "7.4.0": "4.0.36.Final", + "7.5.0": "4.0.36.Final", + "7.6.0": "4.0.36.Final", + "7.7.0": "4.0.36.Final", + "7.7.1": "4.0.36.Final", + "7.7.2": "4.0.36.Final", + "7.7.3": "4.0.36.Final", + "8.0.0": "4.0.52.Final", + "8.1.0": "4.0.52.Final", + "8.1.1": "4.0.52.Final", + "8.2.0": "4.0.52.Final", + "8.3.0": "4.1.29.Final", + "8.3.1": "4.1.29.Final", + "8.4.0": "4.1.29.Final", + "8.4.1": "4.1.29.Final", + "8.5.0": "4.1.29.Final", + "8.5.1": "4.1.29.Final", + "8.5.2": "4.1.29.Final", + "8.6.0": "4.1.47.Final", + "8.6.1": "4.1.47.Final", + "8.6.2": "4.1.47.Final", + "8.6.3": "4.1.47.Final", + "8.7.0": "4.1.50.Final", + "8.8.0": "4.1.50.Final", + "8.8.1": "4.1.50.Final" + }, + "junit:junit": { + "10.0.0": "4.13.2", + "3.6.0": "4.10", + "3.6.1": "4.10", + "3.6.2": "4.10", + "4.0.0": "4.10", + "4.1.0": "4.10", + "4.10.0": "4.10", + "4.10.1": "4.10", + "4.10.2": "4.10", + "4.10.3": "4.10", + "4.10.4": "4.10", + "4.2.0": "4.10", + "4.2.1": "4.10", + "4.3.0": "4.10", + "4.3.1": "4.10", + "4.4.0": "4.10", + "4.5.0": "4.10", + "4.5.1": "4.10", + "4.6.0": "4.10", + "4.6.1": "4.10", + "4.7.0": "4.10", + "4.7.1": "4.10", + "4.7.2": "4.10", + "4.8.0": "4.10", + "4.8.1": "4.10", + "4.9.0": "4.10", + "4.9.1": "4.10", + "5.0.0": "4.10", + "5.1.0": "4.10", + "5.2.0": "4.10", + "5.2.1": "4.10", + "5.3.0": "4.10", + "5.3.1": "4.10", + "5.3.2": "4.10", + "5.4.0": "4.10", + "5.4.1": "4.10", + "5.5.0": "4.10", + "5.5.1": "4.10", + "5.5.2": "4.10", + "5.5.3": "4.10", + "5.5.4": "4.10", + "5.5.5": "4.10", + "6.0.0": "4.10", + "6.0.1": "4.10", + "6.1.0": "4.10", + "6.2.0": "4.10", + "6.2.1": "4.10", + "6.3.0": "4.10", + "6.4.0": "4.10", + "6.4.1": "4.10", + "6.4.2": "4.10", + "6.5.0": "4.10", + "6.5.1": "4.10", + "6.6.0": "4.10", + "6.6.1": "4.10", + "6.6.2": "4.10", + "6.6.3": "4.10", + "6.6.4": "4.10", + "6.6.5": "4.10", + "6.6.6": "4.10", + "7.0.0": "4.10", + "7.0.1": "4.10", + "7.1.0": "4.10", + "7.2.0": "4.10", + "7.2.1": "4.10", + "7.3.0": "4.10", + "7.3.1": "4.10", + "7.4.0": "4.10", + "7.5.0": "4.10", + "7.6.0": "4.10", + "7.7.0": "4.12", + "7.7.1": "4.12", + "7.7.2": "4.12", + "7.7.3": "4.12", + "8.0.0": "4.12", + "8.1.0": "4.12", + "8.1.1": "4.12", + "8.2.0": "4.12", + "8.3.0": "4.12", + "8.3.1": "4.12", + "8.4.0": "4.12", + "8.4.1": "4.12", + "8.5.0": "4.12", + "8.5.1": "4.12", + "8.5.2": "4.12", + "8.6.0": "4.12", + "8.6.1": "4.12", + "8.6.2": "4.12", + "8.6.3": "4.12", + "8.7.0": "4.13.1", + "8.8.0": "4.13.1", + "8.8.1": "4.13.1", + "9.0.0": "4.13.2", + "9.1.0": "4.13.2", + "9.1.1": "4.13.2", + "9.10.0": "4.13.2", + "9.10.1": "4.13.2", + "9.2.0": "4.13.2", + "9.2.1": "4.13.2", + "9.3.0": "4.13.2", + "9.4.0": "4.13.2", + "9.4.1": "4.13.2", + "9.5.0": "4.13.2", + "9.6.0": "4.13.2", + "9.6.1": "4.13.2", + "9.7.0": "4.13.2", + "9.8.0": "4.13.2", + "9.8.1": "4.13.2", + "9.9.0": "4.13.2" + }, + "org.apache.calcite.avatica:avatica-core": { + "10.0.0": "1.25.0", + "6.5.0": "1.9.0", + "6.5.1": "1.9.0", + "6.6.0": "1.9.0", + "6.6.1": "1.9.0", + "6.6.2": "1.9.0", + "6.6.3": "1.9.0", + "6.6.4": "1.9.0", + "6.6.5": "1.9.0", + "6.6.6": "1.9.0", + "7.0.0": "1.10.0", + "7.0.1": "1.10.0", + "7.1.0": "1.10.0", + "7.2.0": "1.10.0", + "7.2.1": "1.10.0", + "7.3.0": "1.10.0", + "7.3.1": "1.10.0", + "7.4.0": "1.10.0", + "7.5.0": "1.10.0", + "7.6.0": "1.10.0", + "7.7.0": "1.10.0", + "7.7.1": "1.10.0", + "7.7.2": "1.10.0", + "7.7.3": "1.10.0", + "8.0.0": "1.10.0", + "8.1.0": "1.13.0", + "8.1.1": "1.13.0", + "8.2.0": "1.13.0", + "8.3.0": "1.13.0", + "8.3.1": "1.13.0", + "8.4.0": "1.13.0", + "8.4.1": "1.13.0", + "8.5.0": "1.13.0", + "8.5.1": "1.13.0", + "8.5.2": "1.13.0", + "8.6.0": "1.13.0", + "8.6.1": "1.13.0", + "8.6.2": "1.13.0", + "8.6.3": "1.13.0", + "8.7.0": "1.13.0", + "8.8.0": "1.13.0", + "8.8.1": "1.13.0", + "9.0.0": "1.18.0", + "9.1.0": "1.22.0", + "9.1.1": "1.22.0", + "9.10.0": "1.25.0", + "9.10.1": "1.25.0", + "9.2.0": "1.23.0", + "9.2.1": "1.23.0", + "9.3.0": "1.23.0", + "9.4.0": "1.23.0", + "9.4.1": "1.23.0", + "9.5.0": "1.23.0", + "9.6.0": "1.23.0", + "9.6.1": "1.23.0", + "9.7.0": "1.25.0", + "9.8.0": "1.25.0", + "9.8.1": "1.25.0", + "9.9.0": "1.25.0" + }, + "org.apache.calcite:calcite-core": { + "10.0.0": "1.37.0", + "6.5.0": "1.11.0", + "6.5.1": "1.11.0", + "6.6.0": "1.11.0", + "6.6.1": "1.11.0", + "6.6.2": "1.11.0", + "6.6.3": "1.11.0", + "6.6.4": "1.11.0", + "6.6.5": "1.11.0", + "6.6.6": "1.11.0", + "7.0.0": "1.13.0", + "7.0.1": "1.13.0", + "7.1.0": "1.13.0", + "7.2.0": "1.13.0", + "7.2.1": "1.13.0", + "7.3.0": "1.13.0", + "7.3.1": "1.13.0", + "7.4.0": "1.13.0", + "7.5.0": "1.13.0", + "7.6.0": "1.13.0", + "7.7.0": "1.13.0", + "7.7.1": "1.13.0", + "7.7.2": "1.13.0", + "7.7.3": "1.13.0", + "8.0.0": "1.13.0", + "8.1.0": "1.18.0", + "8.1.1": "1.18.0", + "8.2.0": "1.18.0", + "8.3.0": "1.18.0", + "8.3.1": "1.18.0", + "8.4.0": "1.18.0", + "8.4.1": "1.18.0", + "8.5.0": "1.18.0", + "8.5.1": "1.18.0", + "8.5.2": "1.18.0", + "8.6.0": "1.18.0", + "8.6.1": "1.18.0", + "8.6.2": "1.18.0", + "8.6.3": "1.18.0", + "8.7.0": "1.18.0", + "8.8.0": "1.18.0", + "8.8.1": "1.18.0", + "9.0.0": "1.27.0", + "9.1.0": "1.32.0", + "9.1.1": "1.32.0", + "9.10.0": "1.37.0", + "9.10.1": "1.37.0", + "9.2.0": "1.33.0", + "9.2.1": "1.33.0", + "9.3.0": "1.34.0", + "9.4.0": "1.35.0", + "9.4.1": "1.35.0", + "9.5.0": "1.35.0", + "9.6.0": "1.35.0", + "9.6.1": "1.35.0", + "9.7.0": "1.37.0", + "9.8.0": "1.37.0", + "9.8.1": "1.37.0", + "9.9.0": "1.37.0" + }, + "org.apache.commons:commons-compress": { + "10.0.0": "1.28.0", + "3.6.0": "1.3", + "3.6.1": "1.3", + "3.6.2": "1.3", + "4.0.0": "1.4.1", + "4.1.0": "1.4.1", + "4.10.0": "1.7", + "4.10.1": "1.7", + "4.10.2": "1.7", + "4.10.3": "1.7", + "4.10.4": "1.7", + "4.2.0": "1.4.1", + "4.2.1": "1.4.1", + "4.3.0": "1.4.1", + "4.3.1": "1.4.1", + "4.4.0": "1.4.1", + "4.5.0": "1.4.1", + "4.5.1": "1.4.1", + "4.6.0": "1.4.1", + "4.6.1": "1.4.1", + "4.7.0": "1.7", + "4.7.1": "1.7", + "4.7.2": "1.7", + "4.8.0": "1.7", + "4.8.1": "1.7", + "4.9.0": "1.7", + "4.9.1": "1.7", + "5.0.0": "1.8.1", + "5.1.0": "1.8.1", + "5.2.0": "1.8.1", + "5.2.1": "1.8.1", + "5.3.0": "1.8.1", + "5.3.1": "1.8.1", + "5.3.2": "1.8.1", + "5.4.0": "1.8.1", + "5.4.1": "1.8.1", + "5.5.0": "1.8.1", + "5.5.1": "1.8.1", + "5.5.2": "1.8.1", + "5.5.3": "1.8.1", + "5.5.4": "1.8.1", + "5.5.5": "1.8.1", + "6.0.0": "1.8.1", + "6.0.1": "1.8.1", + "6.1.0": "1.8.1", + "6.2.0": "1.11", + "6.2.1": "1.11", + "6.3.0": "1.11", + "6.4.0": "1.11", + "6.4.1": "1.11", + "6.4.2": "1.11", + "6.5.0": "1.11", + "6.5.1": "1.11", + "6.6.0": "1.11", + "6.6.1": "1.11", + "6.6.2": "1.14", + "6.6.3": "1.14", + "6.6.4": "1.14", + "6.6.5": "1.14", + "6.6.6": "1.14", + "7.0.0": "1.11", + "7.0.1": "1.11", + "7.1.0": "1.14", + "7.2.0": "1.14", + "7.2.1": "1.14", + "7.3.0": "1.14", + "7.3.1": "1.14", + "7.4.0": "1.14", + "7.5.0": "1.18", + "7.6.0": "1.18", + "7.7.0": "1.18", + "7.7.1": "1.18", + "7.7.2": "1.18", + "7.7.3": "1.18", + "8.0.0": "1.18", + "8.1.0": "1.18", + "8.1.1": "1.18", + "8.2.0": "1.18", + "8.3.0": "1.18", + "8.3.1": "1.18", + "8.4.0": "1.18", + "8.4.1": "1.18", + "8.5.0": "1.19", + "8.5.1": "1.19", + "8.5.2": "1.19", + "8.6.0": "1.19", + "8.6.1": "1.19", + "8.6.2": "1.19", + "8.6.3": "1.19", + "8.7.0": "1.20", + "8.8.0": "1.20", + "8.8.1": "1.20", + "9.0.0": "1.21", + "9.1.0": "1.21", + "9.1.1": "1.21", + "9.10.0": "1.28.0", + "9.10.1": "1.28.0", + "9.2.0": "1.22", + "9.2.1": "1.22", + "9.3.0": "1.23.0", + "9.4.0": "1.24.0", + "9.4.1": "1.25.0", + "9.5.0": "1.25.0", + "9.6.0": "1.25.0", + "9.6.1": "1.26.1", + "9.7.0": "1.26.1", + "9.8.0": "1.26.1", + "9.8.1": "1.26.1", + "9.9.0": "1.26.1" + }, + "org.apache.commons:commons-configuration2": { + "8.0.0": "2.1.1", + "8.1.0": "2.1.1", + "8.1.1": "2.1.1", + "8.2.0": "2.1.1", + "8.3.0": "2.1.1", + "8.3.1": "2.1.1", + "8.4.0": "2.1.1", + "8.4.1": "2.1.1", + "8.5.0": "2.1.1", + "8.5.1": "2.1.1", + "8.5.2": "2.1.1", + "8.6.0": "2.1.1", + "8.6.1": "2.1.1", + "8.6.2": "2.1.1", + "8.6.3": "2.1.1", + "8.7.0": "2.1.1", + "8.8.0": "2.1.1", + "8.8.1": "2.1.1", + "9.0.0": "2.7", + "9.1.0": "2.8.0", + "9.1.1": "2.8.0", + "9.10.0": "2.12.0", + "9.10.1": "2.12.0", + "9.2.0": "2.8.0", + "9.2.1": "2.8.0", + "9.3.0": "2.9.0", + "9.4.0": "2.9.0", + "9.4.1": "2.9.0", + "9.5.0": "2.9.0", + "9.6.0": "2.10.1", + "9.6.1": "2.10.1", + "9.7.0": "2.11.0", + "9.8.0": "2.11.0", + "9.8.1": "2.11.0", + "9.9.0": "2.11.0" + }, + "org.apache.commons:commons-lang3": { + "10.0.0": "3.20.0", + "7.0.0": "3.6", + "7.0.1": "3.6", + "7.1.0": "3.6", + "7.2.0": "3.6", + "7.2.1": "3.6", + "7.3.0": "3.6", + "7.3.1": "3.6", + "7.4.0": "3.6", + "7.5.0": "3.6", + "7.6.0": "3.6", + "7.7.0": "3.6", + "7.7.1": "3.6", + "7.7.2": "3.6", + "7.7.3": "3.6", + "8.0.0": "3.8.1", + "8.1.0": "3.8.1", + "8.1.1": "3.8.1", + "8.2.0": "3.8.1", + "8.3.0": "3.8.1", + "8.3.1": "3.8.1", + "8.4.0": "3.8.1", + "8.4.1": "3.8.1", + "8.5.0": "3.9", + "8.5.1": "3.9", + "8.5.2": "3.9", + "8.6.0": "3.9", + "8.6.1": "3.9", + "8.6.2": "3.9", + "8.6.3": "3.9", + "8.7.0": "3.10", + "8.8.0": "3.10", + "8.8.1": "3.10", + "9.0.0": "3.12.0", + "9.1.0": "3.12.0", + "9.1.1": "3.12.0", + "9.10.0": "3.19.0", + "9.10.1": "3.19.0", + "9.2.0": "3.12.0", + "9.2.1": "3.12.0", + "9.3.0": "3.12.0", + "9.4.0": "3.13.0", + "9.4.1": "3.14.0", + "9.5.0": "3.14.0", + "9.6.0": "3.14.0", + "9.6.1": "3.14.0", + "9.7.0": "3.15.0", + "9.8.0": "3.15.0", + "9.8.1": "3.15.0", + "9.9.0": "3.15.0" + }, + "org.apache.commons:commons-text": { + "10.0.0": "1.15.0", + "8.0.0": "1.4", + "8.1.0": "1.6", + "8.1.1": "1.6", + "8.2.0": "1.6", + "8.3.0": "1.6", + "8.3.1": "1.6", + "8.4.0": "1.6", + "8.4.1": "1.6", + "8.5.0": "1.6", + "8.5.1": "1.6", + "8.5.2": "1.6", + "8.6.0": "1.6", + "8.6.1": "1.6", + "8.6.2": "1.6", + "8.6.3": "1.6", + "8.7.0": "1.6", + "8.8.0": "1.6", + "8.8.1": "1.6", + "9.0.0": "1.8", + "9.1.0": "1.10.0", + "9.1.1": "1.10.0", + "9.10.0": "1.13.1", + "9.10.1": "1.13.1", + "9.2.0": "1.10.0", + "9.2.1": "1.10.0", + "9.3.0": "1.10.0", + "9.4.0": "1.10.0", + "9.4.1": "1.10.0", + "9.5.0": "1.10.0", + "9.6.0": "1.11.0", + "9.6.1": "1.11.0", + "9.7.0": "1.12.0", + "9.8.0": "1.12.0", + "9.8.1": "1.12.0", + "9.9.0": "1.12.0" + }, + "org.apache.hadoop:hadoop-auth": { + "4.10.0": "2.2.0", + "4.10.1": "2.2.0", + "4.10.2": "2.2.0", + "4.10.3": "2.2.0", + "4.10.4": "2.2.0", + "4.4.0": "2.0.5-alpha", + "4.5.0": "2.0.5-alpha", + "4.5.1": "2.0.5-alpha", + "4.6.0": "2.2.0", + "4.6.1": "2.2.0", + "4.7.0": "2.2.0", + "4.7.1": "2.2.0", + "4.7.2": "2.2.0", + "4.8.0": "2.2.0", + "4.8.1": "2.2.0", + "4.9.0": "2.2.0", + "4.9.1": "2.2.0", + "5.0.0": "2.3.0", + "5.1.0": "2.6.0", + "5.2.0": "2.6.0", + "5.2.1": "2.6.0", + "5.3.0": "2.6.0", + "5.3.1": "2.6.0", + "5.3.2": "2.6.0", + "5.4.0": "2.6.0", + "5.4.1": "2.6.0", + "5.5.0": "2.6.0", + "5.5.1": "2.6.0", + "5.5.2": "2.6.0", + "5.5.3": "2.6.0", + "5.5.4": "2.6.0", + "5.5.5": "2.6.0", + "6.0.0": "2.6.0", + "6.0.1": "2.6.0", + "6.1.0": "2.6.0", + "6.2.0": "2.7.2", + "6.2.1": "2.7.2", + "6.3.0": "2.7.2", + "6.4.0": "2.7.2", + "6.4.1": "2.7.2", + "6.4.2": "2.7.2", + "6.5.0": "2.7.2", + "6.5.1": "2.7.2", + "6.6.0": "2.7.2", + "6.6.1": "2.7.4", + "6.6.2": "2.7.4", + "6.6.3": "2.7.4", + "6.6.4": "2.7.4", + "6.6.5": "2.7.4", + "6.6.6": "2.7.4", + "7.0.0": "2.7.4", + "7.0.1": "2.7.4", + "7.1.0": "2.7.4", + "7.2.0": "2.7.4", + "7.2.1": "2.7.4", + "7.3.0": "2.7.4", + "7.3.1": "2.7.4", + "7.4.0": "2.7.4", + "7.5.0": "2.7.4", + "7.6.0": "2.7.4", + "7.7.0": "2.7.4", + "7.7.1": "2.7.4", + "7.7.2": "2.7.4", + "7.7.3": "2.7.4", + "8.0.0": "3.2.0", + "8.1.0": "3.2.0", + "8.1.1": "3.2.0", + "8.2.0": "3.2.0", + "8.3.0": "3.2.0", + "8.3.1": "3.2.0", + "8.4.0": "3.2.0", + "8.4.1": "3.2.0", + "8.5.0": "3.2.0", + "8.5.1": "3.2.0", + "8.5.2": "3.2.0", + "8.6.0": "3.2.0", + "8.6.1": "3.2.0", + "8.6.2": "3.2.0", + "8.6.3": "3.2.0", + "8.7.0": "3.2.0", + "8.8.0": "3.2.0", + "8.8.1": "3.2.0", + "9.0.0": "3.3.2", + "9.1.0": "3.3.4", + "9.1.1": "3.3.4", + "9.10.0": "3.4.1", + "9.10.1": "3.4.1", + "9.2.0": "3.3.4", + "9.2.1": "3.3.5", + "9.3.0": "3.3.5", + "9.4.0": "3.3.5", + "9.4.1": "3.3.5", + "9.5.0": "3.3.6", + "9.6.0": "3.3.6", + "9.6.1": "3.3.6", + "9.7.0": "3.3.6", + "9.8.0": "3.4.0", + "9.8.1": "3.4.0", + "9.9.0": "3.4.0" + }, + "org.apache.hadoop:hadoop-common": { + "4.10.0": "2.2.0", + "4.10.1": "2.2.0", + "4.10.2": "2.2.0", + "4.10.3": "2.2.0", + "4.10.4": "2.2.0", + "4.4.0": "2.0.5-alpha", + "4.5.0": "2.0.5-alpha", + "4.5.1": "2.0.5-alpha", + "4.6.0": "2.2.0", + "4.6.1": "2.2.0", + "4.7.0": "2.2.0", + "4.7.1": "2.2.0", + "4.7.2": "2.2.0", + "4.8.0": "2.2.0", + "4.8.1": "2.2.0", + "4.9.0": "2.2.0", + "4.9.1": "2.2.0", + "5.0.0": "2.3.0", + "5.1.0": "2.6.0", + "5.2.0": "2.6.0", + "5.2.1": "2.6.0", + "5.3.0": "2.6.0", + "5.3.1": "2.6.0", + "5.3.2": "2.6.0", + "5.4.0": "2.6.0", + "5.4.1": "2.6.0", + "5.5.0": "2.6.0", + "5.5.1": "2.6.0", + "5.5.2": "2.6.0", + "5.5.3": "2.6.0", + "5.5.4": "2.6.0", + "5.5.5": "2.6.0", + "6.0.0": "2.6.0", + "6.0.1": "2.6.0", + "6.1.0": "2.6.0", + "6.2.0": "2.7.2", + "6.2.1": "2.7.2", + "6.3.0": "2.7.2", + "6.4.0": "2.7.2", + "6.4.1": "2.7.2", + "6.4.2": "2.7.2", + "6.5.0": "2.7.2", + "6.5.1": "2.7.2", + "6.6.0": "2.7.2", + "6.6.1": "2.7.4", + "6.6.2": "2.7.4", + "6.6.3": "2.7.4", + "6.6.4": "2.7.4", + "6.6.5": "2.7.4", + "6.6.6": "2.7.4", + "7.0.0": "2.7.4", + "7.0.1": "2.7.4", + "7.1.0": "2.7.4", + "7.2.0": "2.7.4", + "7.2.1": "2.7.4", + "7.3.0": "2.7.4", + "7.3.1": "2.7.4", + "7.4.0": "2.7.4", + "7.5.0": "2.7.4", + "7.6.0": "2.7.4", + "7.7.0": "2.7.4", + "7.7.1": "2.7.4", + "7.7.2": "2.7.4", + "7.7.3": "2.7.4", + "8.0.0": "3.2.0", + "8.1.0": "3.2.0", + "8.1.1": "3.2.0", + "8.2.0": "3.2.0", + "8.3.0": "3.2.0", + "8.3.1": "3.2.0", + "8.4.0": "3.2.0", + "8.4.1": "3.2.0", + "8.5.0": "3.2.0", + "8.5.1": "3.2.0", + "8.5.2": "3.2.0", + "8.6.0": "3.2.0", + "8.6.1": "3.2.0", + "8.6.2": "3.2.0", + "8.6.3": "3.2.0", + "8.7.0": "3.2.0", + "8.8.0": "3.2.0", + "8.8.1": "3.2.0", + "9.0.0": "3.3.2", + "9.1.0": "3.3.4", + "9.1.1": "3.3.4", + "9.10.0": "3.4.1", + "9.10.1": "3.4.1", + "9.2.0": "3.3.4", + "9.2.1": "3.3.5", + "9.3.0": "3.3.5", + "9.4.0": "3.3.5", + "9.4.1": "3.3.5", + "9.5.0": "3.3.6", + "9.6.0": "3.3.6", + "9.6.1": "3.3.6", + "9.7.0": "3.3.6", + "9.8.0": "3.4.0", + "9.8.1": "3.4.0", + "9.9.0": "3.4.0" + }, + "org.apache.hadoop:hadoop-hdfs": { + "4.10.0": "2.2.0", + "4.10.1": "2.2.0", + "4.10.2": "2.2.0", + "4.10.3": "2.2.0", + "4.10.4": "2.2.0", + "4.4.0": "2.0.5-alpha", + "4.5.0": "2.0.5-alpha", + "4.5.1": "2.0.5-alpha", + "4.6.0": "2.2.0", + "4.6.1": "2.2.0", + "4.7.0": "2.2.0", + "4.7.1": "2.2.0", + "4.7.2": "2.2.0", + "4.8.0": "2.2.0", + "4.8.1": "2.2.0", + "4.9.0": "2.2.0", + "4.9.1": "2.2.0", + "5.0.0": "2.3.0", + "5.1.0": "2.6.0", + "5.2.0": "2.6.0", + "5.2.1": "2.6.0", + "5.3.0": "2.6.0", + "5.3.1": "2.6.0", + "5.3.2": "2.6.0", + "5.4.0": "2.6.0", + "5.4.1": "2.6.0", + "5.5.0": "2.6.0", + "5.5.1": "2.6.0", + "5.5.2": "2.6.0", + "5.5.3": "2.6.0", + "5.5.4": "2.6.0", + "5.5.5": "2.6.0", + "6.0.0": "2.6.0", + "6.0.1": "2.6.0", + "6.1.0": "2.6.0", + "6.2.0": "2.7.2", + "6.2.1": "2.7.2", + "6.3.0": "2.7.2", + "6.4.0": "2.7.2", + "6.4.1": "2.7.2", + "6.4.2": "2.7.2", + "6.5.0": "2.7.2", + "6.5.1": "2.7.2", + "6.6.0": "2.7.2", + "6.6.1": "2.7.4", + "6.6.2": "2.7.4", + "6.6.3": "2.7.4", + "6.6.4": "2.7.4", + "6.6.5": "2.7.4", + "6.6.6": "2.7.4", + "7.0.0": "2.7.4", + "7.0.1": "2.7.4", + "7.1.0": "2.7.4", + "7.2.0": "2.7.4", + "7.2.1": "2.7.4", + "7.3.0": "2.7.4", + "7.3.1": "2.7.4", + "7.4.0": "2.7.4", + "7.5.0": "2.7.4", + "7.6.0": "2.7.4", + "7.7.0": "2.7.4", + "7.7.1": "2.7.4", + "7.7.2": "2.7.4", + "7.7.3": "2.7.4", + "8.0.0": "3.2.0", + "8.1.0": "3.2.0", + "8.1.1": "3.2.0", + "8.2.0": "3.2.0", + "8.3.0": "3.2.0", + "8.3.1": "3.2.0", + "8.4.0": "3.2.0", + "8.4.1": "3.2.0", + "8.5.0": "3.2.0", + "8.5.1": "3.2.0", + "8.5.2": "3.2.0", + "8.6.0": "3.2.0", + "8.6.1": "3.2.0", + "8.6.2": "3.2.0", + "8.6.3": "3.2.0", + "8.7.0": "3.2.0", + "8.8.0": "3.2.0", + "8.8.1": "3.2.0", + "9.0.0": "3.3.2", + "9.1.0": "3.3.4", + "9.1.1": "3.3.4", + "9.10.0": "3.4.1", + "9.10.1": "3.4.1", + "9.2.0": "3.3.4", + "9.2.1": "3.3.5", + "9.3.0": "3.3.5", + "9.4.0": "3.3.5", + "9.4.1": "3.3.5", + "9.5.0": "3.3.6", + "9.6.0": "3.3.6", + "9.6.1": "3.3.6", + "9.7.0": "3.3.6", + "9.8.0": "3.4.0", + "9.8.1": "3.4.0", + "9.9.0": "3.4.0" + }, + "org.apache.logging.log4j:log4j-1.2-api": { + "10.0.0": "2.25.3", + "7.4.0": "2.11.0", + "7.5.0": "2.11.0", + "7.6.0": "2.11.0", + "7.7.0": "2.11.0", + "7.7.1": "2.11.0", + "7.7.2": "2.11.0", + "7.7.3": "2.11.0", + "8.0.0": "2.11.0", + "8.1.0": "2.11.2", + "8.1.1": "2.11.2", + "8.2.0": "2.11.2", + "8.3.0": "2.11.2", + "8.3.1": "2.11.2", + "8.4.0": "2.11.2", + "8.4.1": "2.11.2", + "8.5.0": "2.11.2", + "8.5.1": "2.11.2", + "8.5.2": "2.11.2", + "8.6.0": "2.13.2", + "8.6.1": "2.13.2", + "8.6.2": "2.13.2", + "8.6.3": "2.13.2", + "8.7.0": "2.13.2", + "8.8.0": "2.13.2", + "8.8.1": "2.13.2", + "9.0.0": "2.17.1", + "9.1.0": "2.17.2", + "9.1.1": "2.17.2", + "9.10.0": "2.21.0", + "9.10.1": "2.25.3", + "9.2.0": "2.20.0", + "9.2.1": "2.20.0", + "9.3.0": "2.20.0", + "9.4.0": "2.20.0", + "9.4.1": "2.21.0", + "9.5.0": "2.21.0", + "9.6.0": "2.21.0", + "9.6.1": "2.21.0", + "9.7.0": "2.21.0", + "9.8.0": "2.21.0", + "9.8.1": "2.21.0", + "9.9.0": "2.21.0" + }, + "org.apache.logging.log4j:log4j-core": { + "10.0.0": "2.25.3", + "7.4.0": "2.11.0", + "7.5.0": "2.11.0", + "7.6.0": "2.11.0", + "7.7.0": "2.11.0", + "7.7.1": "2.11.0", + "7.7.2": "2.11.0", + "7.7.3": "2.11.0", + "8.0.0": "2.11.0", + "8.1.0": "2.11.2", + "8.1.1": "2.11.2", + "8.2.0": "2.11.2", + "8.3.0": "2.11.2", + "8.3.1": "2.11.2", + "8.4.0": "2.11.2", + "8.4.1": "2.11.2", + "8.5.0": "2.11.2", + "8.5.1": "2.11.2", + "8.5.2": "2.11.2", + "8.6.0": "2.13.2", + "8.6.1": "2.13.2", + "8.6.2": "2.13.2", + "8.6.3": "2.13.2", + "8.7.0": "2.13.2", + "8.8.0": "2.13.2", + "8.8.1": "2.13.2", + "9.0.0": "2.17.1", + "9.1.0": "2.17.2", + "9.1.1": "2.17.2", + "9.10.0": "2.21.0", + "9.10.1": "2.25.3", + "9.2.0": "2.20.0", + "9.2.1": "2.20.0", + "9.3.0": "2.20.0", + "9.4.0": "2.20.0", + "9.4.1": "2.21.0", + "9.5.0": "2.21.0", + "9.6.0": "2.21.0", + "9.6.1": "2.21.0", + "9.7.0": "2.21.0", + "9.8.0": "2.21.0", + "9.8.1": "2.21.0", + "9.9.0": "2.21.0" + }, + "org.apache.logging.log4j:log4j-layout-template-json": { + "10.0.0": "2.25.3", + "9.0.0": "2.17.1", + "9.1.0": "2.17.2", + "9.1.1": "2.17.2", + "9.10.0": "2.21.0", + "9.10.1": "2.25.3", + "9.2.0": "2.20.0", + "9.2.1": "2.20.0", + "9.3.0": "2.20.0", + "9.4.0": "2.20.0", + "9.4.1": "2.21.0", + "9.5.0": "2.21.0", + "9.6.0": "2.21.0", + "9.6.1": "2.21.0", + "9.7.0": "2.21.0", + "9.8.0": "2.21.0", + "9.8.1": "2.21.0", + "9.9.0": "2.21.0" + }, + "org.apache.opennlp:opennlp-tools": { + "10.0.0": "2.5.6", + "7.3.0": "1.8.3", + "7.3.1": "1.8.3", + "7.4.0": "1.8.3", + "7.5.0": "1.9.0", + "7.6.0": "1.9.0", + "7.7.0": "1.9.0", + "7.7.1": "1.9.0", + "7.7.2": "1.9.0", + "7.7.3": "1.9.0", + "8.0.0": "1.9.1", + "8.1.0": "1.9.1", + "8.1.1": "1.9.1", + "8.2.0": "1.9.1", + "8.3.0": "1.9.1", + "8.3.1": "1.9.1", + "8.4.0": "1.9.1", + "8.4.1": "1.9.1", + "8.5.0": "1.9.1", + "8.5.1": "1.9.1", + "8.5.2": "1.9.1", + "8.6.0": "1.9.1", + "8.6.1": "1.9.1", + "8.6.2": "1.9.1", + "8.6.3": "1.9.1", + "8.7.0": "1.9.2", + "8.8.0": "1.9.2", + "8.8.1": "1.9.2", + "9.0.0": "1.9.4", + "9.1.0": "1.9.4", + "9.1.1": "1.9.4", + "9.10.0": "1.9.4", + "9.10.1": "1.9.4", + "9.2.0": "1.9.4", + "9.2.1": "1.9.4", + "9.3.0": "1.9.4", + "9.4.0": "1.9.4", + "9.4.1": "1.9.4", + "9.5.0": "1.9.4", + "9.6.0": "1.9.4", + "9.6.1": "1.9.4", + "9.7.0": "1.9.4", + "9.8.0": "1.9.4", + "9.8.1": "1.9.4", + "9.9.0": "1.9.4" + }, + "org.apache.tika:tika-core": { + "10.0.0": "3.2.3", + "3.6.0": "1.0", + "3.6.1": "1.0", + "3.6.2": "1.0", + "4.0.0": "1.2", + "4.1.0": "1.2", + "4.10.0": "1.5", + "4.10.1": "1.5", + "4.10.2": "1.5", + "4.10.3": "1.5", + "4.10.4": "1.5", + "4.2.0": "1.3", + "4.2.1": "1.3", + "4.3.0": "1.3", + "4.3.1": "1.3", + "4.4.0": "1.4", + "4.5.0": "1.4", + "4.5.1": "1.4", + "4.6.0": "1.4", + "4.6.1": "1.4", + "4.7.0": "1.4", + "4.7.1": "1.4", + "4.7.2": "1.4", + "4.8.0": "1.5", + "4.8.1": "1.5", + "4.9.0": "1.5", + "4.9.1": "1.5", + "5.0.0": "1.7", + "5.1.0": "1.7", + "5.2.0": "1.7", + "5.2.1": "1.7", + "5.3.0": "1.7", + "5.3.1": "1.7", + "5.3.2": "1.7", + "5.4.0": "1.7", + "5.4.1": "1.7", + "5.5.0": "1.7", + "5.5.1": "1.7", + "5.5.2": "1.7", + "5.5.3": "1.7", + "5.5.4": "1.7", + "5.5.5": "1.7", + "6.0.0": "1.7", + "6.0.1": "1.7", + "6.1.0": "1.7", + "6.2.0": "1.13", + "6.2.1": "1.13", + "6.3.0": "1.13", + "6.4.0": "1.13", + "6.4.1": "1.13", + "6.4.2": "1.13", + "6.5.0": "1.13", + "6.5.1": "1.13", + "6.6.0": "1.13", + "6.6.1": "1.13", + "6.6.2": "1.16", + "6.6.3": "1.16", + "6.6.4": "1.16", + "6.6.5": "1.16", + "6.6.6": "1.16", + "7.0.0": "1.13", + "7.0.1": "1.13", + "7.1.0": "1.16", + "7.2.0": "1.16", + "7.2.1": "1.16", + "7.3.0": "1.17", + "7.3.1": "1.17", + "7.4.0": "1.17", + "7.5.0": "1.18", + "7.6.0": "1.19.1", + "7.7.0": "1.19.1", + "7.7.1": "1.19.1", + "7.7.2": "1.19.1", + "7.7.3": "1.19.1", + "8.0.0": "1.19.1", + "8.1.0": "1.19.1", + "8.1.1": "1.19.1", + "8.2.0": "1.19.1", + "8.3.0": "1.19.1", + "8.3.1": "1.19.1", + "8.4.0": "1.19.1", + "8.4.1": "1.19.1", + "8.5.0": "1.23", + "8.5.1": "1.23", + "8.5.2": "1.23", + "8.6.0": "1.24", + "8.6.1": "1.24", + "8.6.2": "1.24", + "8.6.3": "1.24", + "8.7.0": "1.24.1", + "8.8.0": "1.24.1", + "8.8.1": "1.24.1", + "9.0.0": "1.28.1", + "9.1.0": "1.28.4", + "9.1.1": "1.28.4", + "9.10.0": "1.28.5", + "9.10.1": "1.28.5", + "9.2.0": "1.28.5", + "9.2.1": "1.28.5", + "9.3.0": "1.28.5", + "9.4.0": "1.28.5", + "9.4.1": "1.28.5", + "9.5.0": "1.28.5", + "9.6.0": "1.28.5", + "9.6.1": "1.28.5", + "9.7.0": "1.28.5", + "9.8.0": "1.28.5", + "9.8.1": "1.28.5", + "9.9.0": "1.28.5" + }, + "org.apache.velocity:velocity-tools": { + "3.6.0": "2.0", + "3.6.1": "2.0", + "3.6.2": "2.0", + "4.0.0": "2.0", + "4.1.0": "2.0", + "4.10.0": "2.0", + "4.10.1": "2.0", + "4.10.2": "2.0", + "4.10.3": "2.0", + "4.10.4": "2.0", + "4.2.0": "2.0", + "4.2.1": "2.0", + "4.3.0": "2.0", + "4.3.1": "2.0", + "4.4.0": "2.0", + "4.5.0": "2.0", + "4.5.1": "2.0", + "4.6.0": "2.0", + "4.6.1": "2.0", + "4.7.0": "2.0", + "4.7.1": "2.0", + "4.7.2": "2.0", + "4.8.0": "2.0", + "4.8.1": "2.0", + "4.9.0": "2.0", + "4.9.1": "2.0", + "5.0.0": "2.0", + "5.1.0": "2.0", + "5.2.0": "2.0", + "5.2.1": "2.0", + "5.3.0": "2.0", + "5.3.1": "2.0", + "5.3.2": "2.0", + "5.4.0": "2.0", + "5.4.1": "2.0", + "5.5.0": "2.0", + "5.5.1": "2.0", + "5.5.2": "2.0", + "5.5.3": "2.0", + "5.5.4": "2.0", + "5.5.5": "2.0", + "6.0.0": "2.0", + "6.0.1": "2.0", + "6.1.0": "2.0", + "6.2.0": "2.0", + "6.2.1": "2.0", + "6.3.0": "2.0", + "6.4.0": "2.0", + "6.4.1": "2.0", + "6.4.2": "2.0", + "6.5.0": "2.0", + "6.5.1": "2.0", + "6.6.0": "2.0", + "6.6.1": "2.0", + "6.6.2": "2.0", + "6.6.3": "2.0", + "6.6.4": "2.0", + "6.6.5": "2.0", + "6.6.6": "2.0", + "7.0.0": "2.0", + "7.0.1": "2.0", + "7.1.0": "2.0", + "7.2.0": "2.0", + "7.2.1": "2.0", + "7.3.0": "2.0", + "7.3.1": "2.0", + "7.4.0": "2.0", + "7.5.0": "2.0", + "7.6.0": "2.0", + "7.7.0": "2.0", + "7.7.1": "2.0", + "7.7.2": "2.0", + "7.7.3": "2.0", + "8.0.0": "2.0" + }, + "org.apache.zookeeper:zookeeper": { + "10.0.0": "3.9.4", + "4.0.0": "3.3.6", + "4.1.0": "3.4.5", + "4.10.0": "3.4.6", + "4.10.1": "3.4.6", + "4.10.2": "3.4.6", + "4.10.3": "3.4.6", + "4.10.4": "3.4.6", + "4.2.0": "3.4.5", + "4.2.1": "3.4.5", + "4.3.0": "3.4.5", + "4.3.1": "3.4.5", + "4.4.0": "3.4.5", + "4.5.0": "3.4.5", + "4.5.1": "3.4.5", + "4.6.0": "3.4.5", + "4.6.1": "3.4.5", + "4.7.0": "3.4.5", + "4.7.1": "3.4.5", + "4.7.2": "3.4.5", + "4.8.0": "3.4.6", + "4.8.1": "3.4.6", + "4.9.0": "3.4.6", + "4.9.1": "3.4.6", + "5.0.0": "3.4.6", + "5.1.0": "3.4.6", + "5.2.0": "3.4.6", + "5.2.1": "3.4.6", + "5.3.0": "3.4.6", + "5.3.1": "3.4.6", + "5.3.2": "3.4.6", + "5.4.0": "3.4.6", + "5.4.1": "3.4.6", + "5.5.0": "3.4.6", + "5.5.1": "3.4.6", + "5.5.2": "3.4.6", + "5.5.3": "3.4.6", + "5.5.4": "3.4.6", + "5.5.5": "3.4.6", + "6.0.0": "3.4.6", + "6.0.1": "3.4.6", + "6.1.0": "3.4.6", + "6.2.0": "3.4.6", + "6.2.1": "3.4.6", + "6.3.0": "3.4.6", + "6.4.0": "3.4.6", + "6.4.1": "3.4.6", + "6.4.2": "3.4.6", + "6.5.0": "3.4.6", + "6.5.1": "3.4.6", + "6.6.0": "3.4.10", + "6.6.1": "3.4.10", + "6.6.2": "3.4.10", + "6.6.3": "3.4.10", + "6.6.4": "3.4.10", + "6.6.5": "3.4.10", + "6.6.6": "3.4.10", + "7.0.0": "3.4.10", + "7.0.1": "3.4.10", + "7.1.0": "3.4.10", + "7.2.0": "3.4.10", + "7.2.1": "3.4.10", + "7.3.0": "3.4.11", + "7.3.1": "3.4.11", + "7.4.0": "3.4.11", + "7.5.0": "3.4.11", + "7.6.0": "3.4.11", + "7.7.0": "3.4.13", + "7.7.1": "3.4.13", + "7.7.2": "3.4.14", + "7.7.3": "3.4.14", + "8.0.0": "3.4.13", + "8.1.0": "3.4.14", + "8.1.1": "3.4.14", + "8.2.0": "3.5.5", + "8.3.0": "3.5.5", + "8.3.1": "3.5.5", + "8.4.0": "3.5.5", + "8.4.1": "3.5.5", + "8.5.0": "3.5.5", + "8.5.1": "3.5.5", + "8.5.2": "3.5.5", + "8.6.0": "3.5.7", + "8.6.1": "3.5.7", + "8.6.2": "3.5.7", + "8.6.3": "3.5.7", + "8.7.0": "3.6.2", + "8.8.0": "3.6.2", + "8.8.1": "3.6.2", + "9.0.0": "3.7.0", + "9.1.0": "3.8.0", + "9.1.1": "3.8.0", + "9.10.0": "3.9.4", + "9.10.1": "3.9.4", + "9.2.0": "3.8.1", + "9.2.1": "3.8.1", + "9.3.0": "3.8.1", + "9.4.0": "3.9.0", + "9.4.1": "3.9.1", + "9.5.0": "3.9.1", + "9.6.0": "3.9.1", + "9.6.1": "3.9.1", + "9.7.0": "3.9.2", + "9.8.0": "3.9.2", + "9.8.1": "3.9.2", + "9.9.0": "3.9.3" + }, + "org.carrot2.shaded:carrot2-guava": { + "5.4.0": "18.0", + "5.4.1": "18.0", + "5.5.0": "18.0", + "5.5.1": "18.0", + "5.5.2": "18.0", + "5.5.3": "18.0", + "5.5.4": "18.0", + "5.5.5": "18.0", + "6.0.0": "18.0", + "6.0.1": "18.0", + "6.1.0": "18.0", + "6.2.0": "18.0", + "6.2.1": "18.0", + "6.3.0": "18.0", + "6.4.0": "18.0", + "6.4.1": "18.0", + "6.4.2": "18.0", + "6.5.0": "18.0", + "6.5.1": "18.0", + "6.6.0": "18.0", + "6.6.1": "18.0", + "6.6.2": "18.0", + "6.6.3": "18.0", + "6.6.4": "18.0", + "6.6.5": "18.0", + "6.6.6": "18.0", + "7.0.0": "18.0", + "7.0.1": "18.0", + "7.1.0": "18.0", + "7.2.0": "18.0", + "7.2.1": "18.0", + "7.3.0": "18.0", + "7.3.1": "18.0", + "7.4.0": "18.0", + "7.5.0": "18.0", + "7.6.0": "18.0", + "7.7.0": "18.0", + "7.7.1": "18.0", + "7.7.2": "18.0", + "7.7.3": "18.0", + "8.0.0": "18.0", + "8.1.0": "18.0", + "8.1.1": "18.0", + "8.2.0": "18.0", + "8.3.0": "18.0", + "8.3.1": "18.0", + "8.4.0": "18.0", + "8.4.1": "18.0", + "8.5.0": "18.0", + "8.5.1": "18.0", + "8.5.2": "18.0", + "8.6.0": "18.0", + "8.6.1": "18.0", + "8.6.2": "18.0", + "8.6.3": "18.0", + "8.7.0": "18.0" + }, + "org.eclipse.jetty:jetty-http": { + "10.0.0": "12.0.27", + "4.0.0": "8.1.2.v20120308", + "4.1.0": "8.1.8.v20121106", + "4.10.0": "8.1.10.v20130312", + "4.10.1": "8.1.10.v20130312", + "4.10.2": "8.1.10.v20130312", + "4.10.3": "8.1.10.v20130312", + "4.10.4": "8.1.10.v20130312", + "4.2.0": "8.1.8.v20121106", + "4.2.1": "8.1.8.v20121106", + "4.3.0": "8.1.8.v20121106", + "4.3.1": "8.1.8.v20121106", + "4.4.0": "8.1.10.v20130312", + "4.5.0": "8.1.10.v20130312", + "4.5.1": "8.1.10.v20130312", + "4.6.0": "8.1.10.v20130312", + "4.6.1": "8.1.10.v20130312", + "4.7.0": "8.1.10.v20130312", + "4.7.1": "8.1.10.v20130312", + "4.7.2": "8.1.10.v20130312", + "4.8.0": "8.1.10.v20130312", + "4.8.1": "8.1.10.v20130312", + "4.9.0": "8.1.10.v20130312", + "4.9.1": "8.1.10.v20130312", + "5.0.0": "8.1.10.v20130312", + "5.1.0": "8.1.10.v20130312", + "5.2.0": "9.2.10.v20150310", + "5.2.1": "9.2.10.v20150310", + "5.3.0": "9.2.11.v20150529", + "5.3.1": "9.2.11.v20150529", + "5.3.2": "9.2.11.v20150529", + "5.4.0": "9.2.13.v20150730", + "5.4.1": "9.2.13.v20150730", + "5.5.0": "9.2.13.v20150730", + "5.5.1": "9.2.13.v20150730", + "5.5.2": "9.2.13.v20150730", + "5.5.3": "9.2.13.v20150730", + "5.5.4": "9.2.13.v20150730", + "5.5.5": "9.2.13.v20150730", + "6.0.0": "9.3.8.v20160314", + "6.0.1": "9.3.8.v20160314", + "6.1.0": "9.3.8.v20160314", + "6.2.0": "9.3.8.v20160314", + "6.2.1": "9.3.8.v20160314", + "6.3.0": "9.3.8.v20160314", + "6.4.0": "9.3.14.v20161028", + "6.4.1": "9.3.14.v20161028", + "6.4.2": "9.3.14.v20161028", + "6.5.0": "9.3.14.v20161028", + "6.5.1": "9.3.14.v20161028", + "6.6.0": "9.3.14.v20161028", + "6.6.1": "9.3.14.v20161028", + "6.6.2": "9.3.14.v20161028", + "6.6.3": "9.3.14.v20161028", + "6.6.4": "9.3.14.v20161028", + "6.6.5": "9.3.14.v20161028", + "6.6.6": "9.3.14.v20161028", + "7.0.0": "9.3.14.v20161028", + "7.0.1": "9.3.14.v20161028", + "7.1.0": "9.3.20.v20170531", + "7.2.0": "9.3.20.v20170531", + "7.2.1": "9.3.20.v20170531", + "7.3.0": "9.4.8.v20171121", + "7.3.1": "9.4.8.v20171121", + "7.4.0": "9.4.10.v20180503", + "7.5.0": "9.4.11.v20180605", + "7.6.0": "9.4.11.v20180605", + "7.7.0": "9.4.14.v20181114", + "7.7.1": "9.4.14.v20181114", + "7.7.2": "9.4.14.v20181114", + "7.7.3": "9.4.14.v20181114", + "8.0.0": "9.4.14.v20181114", + "8.1.0": "9.4.14.v20181114", + "8.1.1": "9.4.14.v20181114", + "8.2.0": "9.4.19.v20190610", + "8.3.0": "9.4.19.v20190610", + "8.3.1": "9.4.19.v20190610", + "8.4.0": "9.4.19.v20190610", + "8.4.1": "9.4.19.v20190610", + "8.5.0": "9.4.24.v20191120", + "8.5.1": "9.4.24.v20191120", + "8.5.2": "9.4.24.v20191120", + "8.6.0": "9.4.27.v20200227", + "8.6.1": "9.4.27.v20200227", + "8.6.2": "9.4.27.v20200227", + "8.6.3": "9.4.27.v20200227", + "8.7.0": "9.4.27.v20200227", + "8.8.0": "9.4.34.v20201102", + "8.8.1": "9.4.34.v20201102", + "9.0.0": "9.4.44.v20210927", + "9.1.0": "9.4.48.v20220622", + "9.1.1": "9.4.48.v20220622", + "9.10.0": "10.0.26", + "9.10.1": "10.0.26", + "9.2.0": "10.0.13", + "9.2.1": "10.0.13", + "9.3.0": "10.0.15", + "9.4.0": "10.0.17", + "9.4.1": "10.0.19", + "9.5.0": "10.0.19", + "9.6.0": "10.0.20", + "9.6.1": "10.0.20", + "9.7.0": "10.0.22", + "9.8.0": "10.0.22", + "9.8.1": "10.0.22", + "9.9.0": "10.0.22" + }, + "org.eclipse.jetty:jetty-server": { + "10.0.0": "12.0.27", + "4.0.0": "8.1.2.v20120308", + "4.1.0": "8.1.8.v20121106", + "4.10.0": "8.1.10.v20130312", + "4.10.1": "8.1.10.v20130312", + "4.10.2": "8.1.10.v20130312", + "4.10.3": "8.1.10.v20130312", + "4.10.4": "8.1.10.v20130312", + "4.2.0": "8.1.8.v20121106", + "4.2.1": "8.1.8.v20121106", + "4.3.0": "8.1.8.v20121106", + "4.3.1": "8.1.8.v20121106", + "4.4.0": "8.1.10.v20130312", + "4.5.0": "8.1.10.v20130312", + "4.5.1": "8.1.10.v20130312", + "4.6.0": "8.1.10.v20130312", + "4.6.1": "8.1.10.v20130312", + "4.7.0": "8.1.10.v20130312", + "4.7.1": "8.1.10.v20130312", + "4.7.2": "8.1.10.v20130312", + "4.8.0": "8.1.10.v20130312", + "4.8.1": "8.1.10.v20130312", + "4.9.0": "8.1.10.v20130312", + "4.9.1": "8.1.10.v20130312", + "5.0.0": "8.1.10.v20130312", + "5.1.0": "8.1.10.v20130312", + "5.2.0": "9.2.10.v20150310", + "5.2.1": "9.2.10.v20150310", + "5.3.0": "9.2.11.v20150529", + "5.3.1": "9.2.11.v20150529", + "5.3.2": "9.2.11.v20150529", + "5.4.0": "9.2.13.v20150730", + "5.4.1": "9.2.13.v20150730", + "5.5.0": "9.2.13.v20150730", + "5.5.1": "9.2.13.v20150730", + "5.5.2": "9.2.13.v20150730", + "5.5.3": "9.2.13.v20150730", + "5.5.4": "9.2.13.v20150730", + "5.5.5": "9.2.13.v20150730", + "6.0.0": "9.3.8.v20160314", + "6.0.1": "9.3.8.v20160314", + "6.1.0": "9.3.8.v20160314", + "6.2.0": "9.3.8.v20160314", + "6.2.1": "9.3.8.v20160314", + "6.3.0": "9.3.8.v20160314", + "6.4.0": "9.3.14.v20161028", + "6.4.1": "9.3.14.v20161028", + "6.4.2": "9.3.14.v20161028", + "6.5.0": "9.3.14.v20161028", + "6.5.1": "9.3.14.v20161028", + "6.6.0": "9.3.14.v20161028", + "6.6.1": "9.3.14.v20161028", + "6.6.2": "9.3.14.v20161028", + "6.6.3": "9.3.14.v20161028", + "6.6.4": "9.3.14.v20161028", + "6.6.5": "9.3.14.v20161028", + "6.6.6": "9.3.14.v20161028", + "7.0.0": "9.3.14.v20161028", + "7.0.1": "9.3.14.v20161028", + "7.1.0": "9.3.20.v20170531", + "7.2.0": "9.3.20.v20170531", + "7.2.1": "9.3.20.v20170531", + "7.3.0": "9.4.8.v20171121", + "7.3.1": "9.4.8.v20171121", + "7.4.0": "9.4.10.v20180503", + "7.5.0": "9.4.11.v20180605", + "7.6.0": "9.4.11.v20180605", + "7.7.0": "9.4.14.v20181114", + "7.7.1": "9.4.14.v20181114", + "7.7.2": "9.4.14.v20181114", + "7.7.3": "9.4.14.v20181114", + "8.0.0": "9.4.14.v20181114", + "8.1.0": "9.4.14.v20181114", + "8.1.1": "9.4.14.v20181114", + "8.2.0": "9.4.19.v20190610", + "8.3.0": "9.4.19.v20190610", + "8.3.1": "9.4.19.v20190610", + "8.4.0": "9.4.19.v20190610", + "8.4.1": "9.4.19.v20190610", + "8.5.0": "9.4.24.v20191120", + "8.5.1": "9.4.24.v20191120", + "8.5.2": "9.4.24.v20191120", + "8.6.0": "9.4.27.v20200227", + "8.6.1": "9.4.27.v20200227", + "8.6.2": "9.4.27.v20200227", + "8.6.3": "9.4.27.v20200227", + "8.7.0": "9.4.27.v20200227", + "8.8.0": "9.4.34.v20201102", + "8.8.1": "9.4.34.v20201102", + "9.0.0": "9.4.44.v20210927", + "9.1.0": "9.4.48.v20220622", + "9.1.1": "9.4.48.v20220622", + "9.10.0": "10.0.26", + "9.10.1": "10.0.26", + "9.2.0": "10.0.13", + "9.2.1": "10.0.13", + "9.3.0": "10.0.15", + "9.4.0": "10.0.17", + "9.4.1": "10.0.19", + "9.5.0": "10.0.19", + "9.6.0": "10.0.20", + "9.6.1": "10.0.20", + "9.7.0": "10.0.22", + "9.8.0": "10.0.22", + "9.8.1": "10.0.22", + "9.9.0": "10.0.22" + }, + "org.gagravarr:vorbis-java-tika": { + "4.0.0": "0.1", + "4.1.0": "0.1", + "4.10.0": "0.1", + "4.10.1": "0.1", + "4.10.2": "0.1", + "4.10.3": "0.1", + "4.10.4": "0.1", + "4.2.0": "0.1", + "4.2.1": "0.1", + "4.3.0": "0.1", + "4.3.1": "0.1", + "4.4.0": "0.1", + "4.5.0": "0.1", + "4.5.1": "0.1", + "4.6.0": "0.1", + "4.6.1": "0.1", + "4.7.0": "0.1", + "4.7.1": "0.1", + "4.7.2": "0.1", + "4.8.0": "0.1", + "4.8.1": "0.1", + "4.9.0": "0.1", + "4.9.1": "0.1", + "5.0.0": "0.6", + "5.1.0": "0.6", + "5.2.0": "0.6", + "5.2.1": "0.6", + "5.3.0": "0.6", + "5.3.1": "0.6", + "5.3.2": "0.6", + "5.4.0": "0.6", + "5.4.1": "0.6", + "5.5.0": "0.6", + "5.5.1": "0.6", + "5.5.2": "0.6", + "5.5.3": "0.6", + "5.5.4": "0.6", + "5.5.5": "0.6", + "6.0.0": "0.6", + "6.0.1": "0.6", + "6.1.0": "0.6", + "6.2.0": "0.8", + "6.2.1": "0.8", + "6.3.0": "0.8", + "6.4.0": "0.8", + "6.4.1": "0.8", + "6.4.2": "0.8", + "6.5.0": "0.8", + "6.5.1": "0.8", + "6.6.0": "0.8", + "6.6.1": "0.8", + "6.6.2": "0.8", + "6.6.3": "0.8", + "6.6.4": "0.8", + "6.6.5": "0.8", + "6.6.6": "0.8", + "7.0.0": "0.8", + "7.0.1": "0.8", + "7.1.0": "0.8", + "7.2.0": "0.8", + "7.2.1": "0.8", + "7.3.0": "0.8", + "7.3.1": "0.8", + "7.4.0": "0.8", + "7.5.0": "0.8", + "7.6.0": "0.8", + "7.7.0": "0.8", + "7.7.1": "0.8", + "7.7.2": "0.8", + "7.7.3": "0.8", + "8.0.0": "0.8", + "8.1.0": "0.8", + "8.1.1": "0.8", + "8.2.0": "0.8", + "8.3.0": "0.8", + "8.3.1": "0.8", + "8.4.0": "0.8", + "8.4.1": "0.8", + "8.5.0": "0.8", + "8.5.1": "0.8", + "8.5.2": "0.8", + "8.6.0": "0.8", + "8.6.1": "0.8", + "8.6.2": "0.8", + "8.6.3": "0.8", + "8.7.0": "0.8", + "8.8.0": "0.8", + "8.8.1": "0.8", + "9.0.0": "0.8", + "9.1.0": "0.8", + "9.1.1": "0.8", + "9.10.0": "0.8", + "9.10.1": "0.8", + "9.2.0": "0.8", + "9.2.1": "0.8", + "9.3.0": "0.8", + "9.4.0": "0.8", + "9.4.1": "0.8", + "9.5.0": "0.8", + "9.6.0": "0.8", + "9.6.1": "0.8", + "9.7.0": "0.8", + "9.8.0": "0.8", + "9.8.1": "0.8", + "9.9.0": "0.8" + }, + "org.jdom:jdom": { + "3.6.0": "1.0", + "3.6.1": "1.0", + "3.6.2": "1.0", + "4.0.0": "1.0", + "4.1.0": "1.0", + "4.10.0": "1.0", + "4.10.1": "1.0", + "4.10.2": "1.0", + "4.10.3": "1.0", + "4.10.4": "1.0", + "4.2.0": "1.0", + "4.2.1": "1.0", + "4.3.0": "1.0", + "4.3.1": "1.0", + "4.4.0": "1.0", + "4.5.0": "1.0", + "4.5.1": "1.0", + "4.6.0": "1.0", + "4.6.1": "1.0", + "4.7.0": "1.0", + "4.7.1": "1.0", + "4.7.2": "1.0", + "4.8.0": "1.0", + "4.8.1": "1.0", + "4.9.0": "1.0", + "4.9.1": "1.0", + "5.0.0": "1.0", + "5.1.0": "1.0", + "5.2.0": "1.0", + "5.2.1": "1.0", + "5.3.0": "1.0", + "5.3.1": "1.0", + "5.3.2": "1.0", + "5.4.0": "1.0", + "5.4.1": "1.0", + "5.5.0": "1.0", + "5.5.1": "1.0", + "5.5.2": "1.0", + "5.5.3": "1.0", + "5.5.4": "1.0", + "5.5.5": "1.0", + "6.0.0": "1.0", + "6.0.1": "1.0", + "6.1.0": "1.0", + "6.2.0": "1.0", + "6.2.1": "1.0", + "6.3.0": "1.0", + "6.4.0": "1.0", + "6.4.1": "1.0", + "6.4.2": "1.0", + "6.5.0": "1.0", + "6.5.1": "1.0", + "6.6.0": "1.0", + "6.6.1": "1.0", + "6.6.2": "1.0", + "6.6.3": "1.0", + "6.6.4": "1.0", + "6.6.5": "1.0", + "6.6.6": "1.0", + "7.0.0": "1.0", + "7.0.1": "1.0", + "7.1.0": "1.0", + "7.2.0": "1.0", + "7.2.1": "1.0", + "7.3.0": "2.0.2", + "7.3.1": "2.0.2", + "7.4.0": "2.0.2" + }, + "org.jdom:jdom2": { + "7.5.0": "2.0.6", + "7.6.0": "2.0.6", + "7.7.0": "2.0.6", + "7.7.1": "2.0.6", + "7.7.2": "2.0.6", + "7.7.3": "2.0.6", + "8.0.0": "2.0.6", + "8.1.0": "2.0.6", + "8.1.1": "2.0.6", + "8.2.0": "2.0.6", + "8.3.0": "2.0.6", + "8.3.1": "2.0.6", + "8.4.0": "2.0.6", + "8.4.1": "2.0.6", + "8.5.0": "2.0.6", + "8.5.1": "2.0.6", + "8.5.2": "2.0.6", + "8.6.0": "2.0.6", + "8.6.1": "2.0.6", + "8.6.2": "2.0.6", + "8.6.3": "2.0.6", + "8.7.0": "2.0.6", + "8.8.0": "2.0.6", + "8.8.1": "2.0.6", + "9.0.0": "2.0.6.1", + "9.1.0": "2.0.6.1", + "9.1.1": "2.0.6.1", + "9.10.0": "2.0.6.1", + "9.10.1": "2.0.6.1", + "9.2.0": "2.0.6.1", + "9.2.1": "2.0.6.1", + "9.3.0": "2.0.6.1", + "9.4.0": "2.0.6.1", + "9.4.1": "2.0.6.1", + "9.5.0": "2.0.6.1", + "9.6.0": "2.0.6.1", + "9.6.1": "2.0.6.1", + "9.7.0": "2.0.6.1", + "9.8.0": "2.0.6.1", + "9.8.1": "2.0.6.1", + "9.9.0": "2.0.6.1" + }, + "org.restlet.jee:org.restlet": { + "4.10.0": "2.1.1", + "4.10.1": "2.1.1", + "4.10.2": "2.1.1", + "4.10.3": "2.1.1", + "4.10.4": "2.1.1", + "4.2.0": "2.1.1", + "4.2.1": "2.1.1", + "4.3.0": "2.1.1", + "4.3.1": "2.1.1", + "4.4.0": "2.1.1", + "4.5.0": "2.1.1", + "4.5.1": "2.1.1", + "4.6.0": "2.1.1", + "4.6.1": "2.1.1", + "4.7.0": "2.1.1", + "4.7.1": "2.1.1", + "4.7.2": "2.1.1", + "4.8.0": "2.1.1", + "4.8.1": "2.1.1", + "4.9.0": "2.1.1", + "4.9.1": "2.1.1", + "5.0.0": "2.1.1", + "5.1.0": "2.1.1", + "5.2.0": "2.3.0", + "5.2.1": "2.3.0", + "5.3.0": "2.3.0", + "5.3.1": "2.3.0", + "5.3.2": "2.3.0", + "5.4.0": "2.3.0", + "5.4.1": "2.3.0", + "5.5.0": "2.3.0", + "5.5.1": "2.3.0", + "5.5.2": "2.3.0", + "5.5.3": "2.3.0", + "5.5.4": "2.3.0", + "5.5.5": "2.3.0", + "6.0.0": "2.3.0", + "6.0.1": "2.3.0", + "6.1.0": "2.3.0", + "6.2.0": "2.3.0", + "6.2.1": "2.3.0", + "6.3.0": "2.3.0", + "6.4.0": "2.3.0", + "6.4.1": "2.3.0", + "6.4.2": "2.3.0", + "6.5.0": "2.3.0", + "6.5.1": "2.3.0", + "6.6.0": "2.3.0", + "6.6.1": "2.3.0", + "6.6.2": "2.3.0", + "6.6.3": "2.3.0", + "6.6.4": "2.3.0", + "6.6.5": "2.3.0", + "6.6.6": "2.3.0", + "7.0.0": "2.3.0", + "7.0.1": "2.3.0", + "7.1.0": "2.3.0", + "7.2.0": "2.3.0", + "7.2.1": "2.3.0", + "7.3.0": "2.3.0", + "7.3.1": "2.3.0", + "7.4.0": "2.3.0", + "7.5.0": "2.3.0", + "7.6.0": "2.3.0", + "7.7.0": "2.3.0", + "7.7.1": "2.3.0", + "7.7.2": "2.3.0", + "7.7.3": "2.3.0", + "8.0.0": "2.3.0", + "8.1.0": "2.3.0", + "8.1.1": "2.3.0", + "8.2.0": "2.3.0", + "8.3.0": "2.3.0", + "8.3.1": "2.3.0", + "8.4.0": "2.3.0", + "8.4.1": "2.3.0", + "8.5.0": "2.4.0", + "8.5.1": "2.4.0", + "8.5.2": "2.4.0", + "8.6.0": "2.4.3", + "8.6.1": "2.4.3", + "8.6.2": "2.4.3", + "8.6.3": "2.4.3" + }, + "org.simpleframework:simple-xml": { + "3.6.0": "2.4.1", + "3.6.1": "2.4.1", + "3.6.2": "2.4.1", + "4.0.0": "2.4.1", + "4.1.0": "2.6.4", + "4.10.0": "2.7", + "4.10.1": "2.7", + "4.10.2": "2.7", + "4.10.3": "2.7", + "4.10.4": "2.7", + "4.2.0": "2.6.4", + "4.2.1": "2.6.4", + "4.3.0": "2.6.4", + "4.3.1": "2.6.4", + "4.4.0": "2.6.4", + "4.5.0": "2.7", + "4.5.1": "2.7", + "4.6.0": "2.7", + "4.6.1": "2.7", + "4.7.0": "2.7", + "4.7.1": "2.7", + "4.7.2": "2.7", + "4.8.0": "2.7", + "4.8.1": "2.7", + "4.9.0": "2.7", + "4.9.1": "2.7", + "5.0.0": "2.7", + "5.1.0": "2.7", + "5.2.0": "2.7", + "5.2.1": "2.7", + "5.3.0": "2.7", + "5.3.1": "2.7", + "5.3.2": "2.7", + "5.4.0": "2.7.1", + "5.4.1": "2.7.1", + "5.5.0": "2.7.1", + "5.5.1": "2.7.1", + "5.5.2": "2.7.1", + "5.5.3": "2.7.1", + "5.5.4": "2.7.1", + "5.5.5": "2.7.1", + "6.0.0": "2.7.1", + "6.0.1": "2.7.1", + "6.1.0": "2.7.1", + "6.2.0": "2.7.1", + "6.2.1": "2.7.1", + "6.3.0": "2.7.1", + "6.4.0": "2.7.1", + "6.4.1": "2.7.1", + "6.4.2": "2.7.1", + "6.5.0": "2.7.1", + "6.5.1": "2.7.1", + "6.6.0": "2.7.1", + "6.6.1": "2.7.1", + "6.6.2": "2.7.1", + "6.6.3": "2.7.1", + "6.6.4": "2.7.1", + "6.6.5": "2.7.1", + "6.6.6": "2.7.1", + "7.0.0": "2.7.1", + "7.0.1": "2.7.1", + "7.1.0": "2.7.1", + "7.2.0": "2.7.1", + "7.2.1": "2.7.1", + "7.3.0": "2.7.1", + "7.3.1": "2.7.1", + "7.4.0": "2.7.1", + "7.5.0": "2.7.1", + "7.6.0": "2.7.1", + "7.7.0": "2.7.1", + "7.7.1": "2.7.1", + "7.7.2": "2.7.1", + "8.0.0": "2.7.1", + "8.1.0": "2.7.1", + "8.1.1": "2.7.1", + "8.2.0": "2.7.1" + }, + "org.slf4j:jcl-over-slf4j": { + "10.0.0": "2.0.17", + "3.6.0": "1.6.1", + "3.6.1": "1.6.1", + "3.6.2": "1.6.1", + "4.0.0": "1.6.4", + "4.1.0": "1.6.4", + "4.10.0": "1.7.6", + "4.10.1": "1.7.6", + "4.10.2": "1.7.6", + "4.10.3": "1.7.6", + "4.10.4": "1.7.6", + "4.2.0": "1.6.4", + "4.2.1": "1.6.4", + "4.3.0": "1.6.6", + "4.3.1": "1.6.6", + "4.4.0": "1.6.6", + "4.5.0": "1.6.6", + "4.5.1": "1.6.6", + "4.6.0": "1.6.6", + "4.6.1": "1.6.6", + "4.7.0": "1.6.6", + "4.7.1": "1.6.6", + "4.7.2": "1.6.6", + "4.8.0": "1.7.6", + "4.8.1": "1.7.6", + "4.9.0": "1.7.6", + "4.9.1": "1.7.6", + "5.0.0": "1.7.7", + "5.1.0": "1.7.7", + "5.2.0": "1.7.7", + "5.2.1": "1.7.7", + "5.3.0": "1.7.7", + "5.3.1": "1.7.7", + "5.3.2": "1.7.7", + "5.4.0": "1.7.7", + "5.4.1": "1.7.7", + "5.5.0": "1.7.7", + "5.5.1": "1.7.7", + "5.5.2": "1.7.7", + "5.5.3": "1.7.7", + "5.5.4": "1.7.7", + "5.5.5": "1.7.7", + "6.0.0": "1.7.7", + "6.0.1": "1.7.7", + "6.1.0": "1.7.7", + "6.2.0": "1.7.7", + "6.2.1": "1.7.7", + "6.3.0": "1.7.7", + "6.4.0": "1.7.7", + "6.4.1": "1.7.7", + "6.4.2": "1.7.7", + "6.5.0": "1.7.7", + "6.5.1": "1.7.7", + "6.6.0": "1.7.7", + "6.6.1": "1.7.7", + "6.6.2": "1.7.7", + "6.6.3": "1.7.7", + "6.6.4": "1.7.7", + "6.6.5": "1.7.7", + "6.6.6": "1.7.7", + "7.0.0": "1.7.7", + "7.0.1": "1.7.7", + "7.1.0": "1.7.7", + "7.2.0": "1.7.7", + "7.2.1": "1.7.7", + "7.3.0": "1.7.24", + "7.3.1": "1.7.24", + "7.4.0": "1.7.24", + "7.5.0": "1.7.24", + "7.6.0": "1.7.24", + "7.7.0": "1.7.24", + "7.7.1": "1.7.24", + "7.7.2": "1.7.24", + "7.7.3": "1.7.24", + "8.0.0": "1.7.24", + "8.1.0": "1.7.24", + "8.1.1": "1.7.24", + "8.2.0": "1.7.24", + "8.3.0": "1.7.24", + "8.3.1": "1.7.24", + "8.4.0": "1.7.24", + "8.4.1": "1.7.24", + "8.5.0": "1.7.24", + "8.5.1": "1.7.24", + "8.5.2": "1.7.24", + "8.6.0": "1.7.24", + "8.6.1": "1.7.24", + "8.6.2": "1.7.24", + "8.6.3": "1.7.24", + "8.7.0": "1.7.24", + "8.8.0": "1.7.24", + "8.8.1": "1.7.24", + "9.0.0": "1.7.36", + "9.1.0": "1.7.36", + "9.1.1": "1.7.36", + "9.10.0": "2.0.17", + "9.10.1": "2.0.17", + "9.2.0": "2.0.6", + "9.2.1": "2.0.6", + "9.3.0": "2.0.7", + "9.4.0": "2.0.9", + "9.4.1": "2.0.10", + "9.5.0": "2.0.10", + "9.6.0": "2.0.12", + "9.6.1": "2.0.12", + "9.7.0": "2.0.13", + "9.8.0": "2.0.13", + "9.8.1": "2.0.13", + "9.9.0": "2.0.13" + }, + "org.slf4j:jul-to-slf4j": { + "10.0.0": "2.0.17", + "4.10.0": "1.7.6", + "4.10.1": "1.7.6", + "4.10.2": "1.7.6", + "4.10.3": "1.7.6", + "4.10.4": "1.7.6", + "4.3.0": "1.6.6", + "4.3.1": "1.6.6", + "4.4.0": "1.6.6", + "4.5.0": "1.6.6", + "4.5.1": "1.6.6", + "4.6.0": "1.6.6", + "4.6.1": "1.6.6", + "4.7.0": "1.6.6", + "4.7.1": "1.6.6", + "4.7.2": "1.6.6", + "4.8.0": "1.7.6", + "4.8.1": "1.7.6", + "4.9.0": "1.7.6", + "4.9.1": "1.7.6", + "5.0.0": "1.7.7", + "5.1.0": "1.7.7", + "5.2.0": "1.7.7", + "5.2.1": "1.7.7", + "5.3.0": "1.7.7", + "5.3.1": "1.7.7", + "5.3.2": "1.7.7", + "5.4.0": "1.7.7", + "5.4.1": "1.7.7", + "5.5.0": "1.7.7", + "5.5.1": "1.7.7", + "5.5.2": "1.7.7", + "5.5.3": "1.7.7", + "5.5.4": "1.7.7", + "5.5.5": "1.7.7", + "6.0.0": "1.7.7", + "6.0.1": "1.7.7", + "6.1.0": "1.7.7", + "6.2.0": "1.7.7", + "6.2.1": "1.7.7", + "6.3.0": "1.7.7", + "6.4.0": "1.7.7", + "6.4.1": "1.7.7", + "6.4.2": "1.7.7", + "6.5.0": "1.7.7", + "6.5.1": "1.7.7", + "6.6.0": "1.7.7", + "6.6.1": "1.7.7", + "6.6.2": "1.7.7", + "6.6.3": "1.7.7", + "6.6.4": "1.7.7", + "6.6.5": "1.7.7", + "6.6.6": "1.7.7", + "7.0.0": "1.7.7", + "7.0.1": "1.7.7", + "7.1.0": "1.7.7", + "7.2.0": "1.7.7", + "7.2.1": "1.7.7", + "7.3.0": "1.7.24", + "7.3.1": "1.7.24", + "7.4.0": "1.7.24", + "7.5.0": "1.7.24", + "7.6.0": "1.7.24", + "7.7.0": "1.7.24", + "7.7.1": "1.7.24", + "7.7.2": "1.7.24", + "7.7.3": "1.7.24", + "8.0.0": "1.7.24", + "8.1.0": "1.7.24", + "8.1.1": "1.7.24", + "8.2.0": "1.7.24", + "8.3.0": "1.7.24", + "8.3.1": "1.7.24", + "8.4.0": "1.7.24", + "8.4.1": "1.7.24", + "8.5.0": "1.7.24", + "8.5.1": "1.7.24", + "8.5.2": "1.7.24", + "8.6.0": "1.7.24", + "8.6.1": "1.7.24", + "8.6.2": "1.7.24", + "8.6.3": "1.7.24", + "8.7.0": "1.7.24", + "8.8.0": "1.7.24", + "8.8.1": "1.7.24", + "9.0.0": "1.7.36", + "9.1.0": "1.7.36", + "9.1.1": "1.7.36", + "9.10.0": "2.0.17", + "9.10.1": "2.0.17", + "9.2.0": "2.0.6", + "9.2.1": "2.0.6", + "9.3.0": "2.0.7", + "9.4.0": "2.0.9", + "9.4.1": "2.0.10", + "9.5.0": "2.0.10", + "9.6.0": "2.0.12", + "9.6.1": "2.0.12", + "9.7.0": "2.0.13", + "9.8.0": "2.0.13", + "9.8.1": "2.0.13", + "9.9.0": "2.0.13" + }, + "org.slf4j:slf4j-api": { + "10.0.0": "2.0.17", + "3.6.0": "1.6.1", + "3.6.1": "1.6.1", + "3.6.2": "1.6.1", + "4.0.0": "1.6.4", + "4.1.0": "1.6.4", + "4.10.0": "1.7.6", + "4.10.1": "1.7.6", + "4.10.2": "1.7.6", + "4.10.3": "1.7.6", + "4.10.4": "1.7.6", + "4.2.0": "1.6.4", + "4.2.1": "1.6.4", + "4.3.0": "1.6.6", + "4.3.1": "1.6.6", + "4.4.0": "1.6.6", + "4.5.0": "1.6.6", + "4.5.1": "1.6.6", + "4.6.0": "1.6.6", + "4.6.1": "1.6.6", + "4.7.0": "1.6.6", + "4.7.1": "1.6.6", + "4.7.2": "1.6.6", + "4.8.0": "1.7.6", + "4.8.1": "1.7.6", + "4.9.0": "1.7.6", + "4.9.1": "1.7.6", + "5.0.0": "1.7.7", + "5.1.0": "1.7.7", + "5.2.0": "1.7.7", + "5.2.1": "1.7.7", + "5.3.0": "1.7.7", + "5.3.1": "1.7.7", + "5.3.2": "1.7.7", + "5.4.0": "1.7.7", + "5.4.1": "1.7.7", + "5.5.0": "1.7.7", + "5.5.1": "1.7.7", + "5.5.2": "1.7.7", + "5.5.3": "1.7.7", + "5.5.4": "1.7.7", + "5.5.5": "1.7.7", + "6.0.0": "1.7.7", + "6.0.1": "1.7.7", + "6.1.0": "1.7.7", + "6.2.0": "1.7.7", + "6.2.1": "1.7.7", + "6.3.0": "1.7.7", + "6.4.0": "1.7.7", + "6.4.1": "1.7.7", + "6.4.2": "1.7.7", + "6.5.0": "1.7.7", + "6.5.1": "1.7.7", + "6.6.0": "1.7.7", + "6.6.1": "1.7.7", + "6.6.2": "1.7.7", + "6.6.3": "1.7.7", + "6.6.4": "1.7.7", + "6.6.5": "1.7.7", + "6.6.6": "1.7.7", + "7.0.0": "1.7.7", + "7.0.1": "1.7.7", + "7.1.0": "1.7.7", + "7.2.0": "1.7.7", + "7.2.1": "1.7.7", + "7.3.0": "1.7.24", + "7.3.1": "1.7.24", + "7.4.0": "1.7.24", + "7.5.0": "1.7.24", + "7.6.0": "1.7.24", + "7.7.0": "1.7.24", + "7.7.1": "1.7.24", + "7.7.2": "1.7.24", + "7.7.3": "1.7.24", + "8.0.0": "1.7.24", + "8.1.0": "1.7.24", + "8.1.1": "1.7.24", + "8.2.0": "1.7.24", + "8.3.0": "1.7.24", + "8.3.1": "1.7.24", + "8.4.0": "1.7.24", + "8.4.1": "1.7.24", + "8.5.0": "1.7.24", + "8.5.1": "1.7.24", + "8.5.2": "1.7.24", + "8.6.0": "1.7.24", + "8.6.1": "1.7.24", + "8.6.2": "1.7.24", + "8.6.3": "1.7.24", + "8.7.0": "1.7.24", + "8.8.0": "1.7.24", + "8.8.1": "1.7.24", + "9.0.0": "1.7.36", + "9.1.0": "1.7.36", + "9.1.1": "1.7.36", + "9.10.0": "2.0.17", + "9.10.1": "2.0.17", + "9.2.0": "2.0.6", + "9.2.1": "2.0.6", + "9.3.0": "2.0.7", + "9.4.0": "2.0.9", + "9.4.1": "2.0.10", + "9.5.0": "2.0.10", + "9.6.0": "2.0.12", + "9.6.1": "2.0.12", + "9.7.0": "2.0.13", + "9.8.0": "2.0.13", + "9.8.1": "2.0.13", + "9.9.0": "2.0.13" + }, + "xerces:xercesImpl": { + "3.6.0": "2.9.1", + "3.6.1": "2.9.1", + "3.6.2": "2.9.1", + "4.0.0": "2.9.1", + "4.1.0": "2.9.1", + "4.10.0": "2.9.1", + "4.10.1": "2.9.1", + "4.10.2": "2.9.1", + "4.10.3": "2.9.1", + "4.10.4": "2.9.1", + "4.2.0": "2.9.1", + "4.2.1": "2.9.1", + "4.3.0": "2.9.1", + "4.3.1": "2.9.1", + "4.4.0": "2.9.1", + "4.5.0": "2.9.1", + "4.5.1": "2.9.1", + "4.6.0": "2.9.1", + "4.6.1": "2.9.1", + "4.7.0": "2.9.1", + "4.7.1": "2.9.1", + "4.7.2": "2.9.1", + "4.8.0": "2.9.1", + "4.8.1": "2.9.1", + "4.9.0": "2.9.1", + "4.9.1": "2.9.1", + "5.0.0": "2.9.1", + "5.1.0": "2.9.1", + "5.2.0": "2.9.1", + "5.2.1": "2.9.1", + "5.3.0": "2.9.1", + "5.3.1": "2.9.1", + "5.3.2": "2.9.1", + "5.4.0": "2.9.1", + "5.4.1": "2.9.1", + "5.5.0": "2.9.1", + "5.5.1": "2.9.1", + "5.5.2": "2.9.1", + "5.5.3": "2.9.1", + "5.5.4": "2.9.1", + "5.5.5": "2.9.1", + "6.0.0": "2.9.1", + "6.0.1": "2.9.1", + "6.1.0": "2.9.1", + "6.2.0": "2.9.1", + "6.2.1": "2.9.1", + "6.3.0": "2.9.1", + "6.4.0": "2.9.1", + "6.4.1": "2.9.1", + "6.4.2": "2.9.1", + "6.5.0": "2.9.1", + "6.5.1": "2.9.1", + "6.6.0": "2.9.1", + "6.6.1": "2.9.1", + "6.6.2": "2.9.1", + "6.6.3": "2.9.1", + "6.6.4": "2.9.1", + "6.6.5": "2.9.1", + "6.6.6": "2.9.1", + "7.0.0": "2.9.1", + "7.0.1": "2.9.1", + "7.1.0": "2.9.1", + "7.2.0": "2.9.1", + "7.2.1": "2.9.1", + "7.3.0": "2.9.1", + "7.3.1": "2.9.1", + "7.4.0": "2.9.1", + "7.5.0": "2.9.1", + "7.6.0": "2.9.1", + "7.7.0": "2.9.1", + "7.7.1": "2.9.1", + "7.7.2": "2.9.1", + "7.7.3": "2.9.1", + "8.0.0": "2.9.1", + "8.1.0": "2.9.1", + "8.1.1": "2.9.1", + "8.2.0": "2.9.1", + "8.3.0": "2.9.1", + "8.3.1": "2.9.1", + "8.4.0": "2.9.1", + "8.4.1": "2.9.1", + "8.5.0": "2.12.0", + "8.5.1": "2.12.0", + "8.5.2": "2.12.0", + "8.6.0": "2.12.0", + "8.6.1": "2.12.0", + "8.6.2": "2.12.0", + "8.6.3": "2.12.0", + "8.7.0": "2.12.0", + "8.8.0": "2.12.0", + "8.8.1": "2.12.0", + "9.0.0": "2.12.2", + "9.1.0": "2.12.2", + "9.1.1": "2.12.2", + "9.10.0": "2.12.2", + "9.10.1": "2.12.2", + "9.2.0": "2.12.2", + "9.2.1": "2.12.2", + "9.3.0": "2.12.2", + "9.4.0": "2.12.2", + "9.4.1": "2.12.2", + "9.5.0": "2.12.2", + "9.6.0": "2.12.2", + "9.6.1": "2.12.2", + "9.7.0": "2.12.2", + "9.8.0": "2.12.2", + "9.8.1": "2.12.2", + "9.9.0": "2.12.2" + } +} diff --git a/plugins/vex/vex.py b/plugins/vex/vex.py index 28134b7f9..37b6c7c87 100644 --- a/plugins/vex/vex.py +++ b/plugins/vex/vex.py @@ -198,7 +198,9 @@ def pelican_init(pelicanobj): 'xercesImpl': 'xerces', 'protobuf-java': 'com.google.protobuf', 'commons-beanutils': 'commons-beanutils', + 'commons-compress': 'org.apache.commons', 'commons-configuration2': 'org.apache.commons', + 'commons-lang3': 'org.apache.commons', 'commons-text': 'org.apache.commons', 'dom4j': 'dom4j', 'avatica-core': 'org.apache.calcite.avatica', @@ -221,6 +223,7 @@ def pelican_init(pelicanobj): 'guava': 'com.google.guava', 'jackson-databind': 'com.fasterxml.jackson.core', 'jdom': 'org.jdom', + 'jdom2': 'org.jdom', 'tika-core': 'org.apache.tika', 'calcite': 'org.apache.calcite', 'calcite-core': 'org.apache.calcite', @@ -252,6 +255,31 @@ def jar_to_component(jar): return {'@id': jar} +def jar_coordinates(jar): + """Parse a JAR name into (group, artifact) when the group is known, else None. + The version in the JAR name is ignored — callers derive the concrete versions + Solr actually shipped from solr-dependency-versions.json.""" + match = _JAR_HYPHEN_RE.match(jar) or _JAR_DOT_RE.match(jar) + if not match: + return None + artifact = match.group(1) + group = JAR_GROUPS.get(artifact) + return (group, artifact) if group else None + + +DEP_VERSIONS_FILE = Path(__file__).resolve().parent / 'solr-dependency-versions.json' +_dep_versions = None + + +def dep_versions(): + """Load the {'group:artifact': {solr_version: dep_version}} map that records + which version of each dependency every Solr release shipped.""" + global _dep_versions + if _dep_versions is None: + _dep_versions = json.loads(DEP_VERSIONS_FILE.read_text()) + return _dep_versions + + # Authoritative list of every released Solr version, used to expand the # free-form `versions` ranges into concrete per-version purls for OpenVEX. VERSIONS_FILE = Path(__file__).resolve().parent / 'solr-versions.txt' @@ -322,15 +350,46 @@ def expand_versions(range_str): return [v for v in solr_versions() if any(_matches_token(_vkey(v), t) for t in tokens)] +def jar_products(jars, versions): + """Turn an entry's vulnerable JARs into OpenVEX product purls. + + A single VEX statement must match a dependency across every Solr image in the + affected range, but each Solr release ships a different pinned version of that + dependency. So for each JAR whose coordinates are known, we expand it to a purl + per concrete dependency version Solr actually shipped over the affected Solr + range (from solr-dependency-versions.json), rather than the single version in + the JAR name. JARs we can't resolve (unknown group, open-lower-bound range, or a + dependency not in the map) fall back to the literal purl from the JAR name.""" + affected_solr = expand_versions(versions) + products, seen = [], set() + + def add(component): + if component['@id'] not in seen: + seen.add(component['@id']) + products.append(component) + + for jar in jars: + coords = jar_coordinates(jar) + shipped = dep_versions().get('%s:%s' % coords) if coords else None + derived = sorted({shipped[sv] for sv in affected_solr if sv in shipped}) \ + if (coords and shipped and affected_solr) else [] + if derived: + group, artifact = coords + for ver in derived: + add({'@id': 'pkg:maven/%s/%s@%s' % (group, artifact, ver)}) + else: + add(jar_to_component(jar)) + return products + + def build_openvex(entries): """Build an OpenVEX (v0.2.0) document from read_vex_articles() entries. - Each entry's free-form `versions` range is expanded (via solr-versions.txt) - into one versioned Solr product purl per affected release, so scanners can - match on version; the vulnerable JARs become subcomponent purls. Entries with - an open lower bound ('≤'/'<'), or 'all'/empty ranges, fall back to a single - version-less product to avoid over-claiming ancient releases (see - expand_versions). + The vulnerable JAR purls are emitted as the statement `products`, because + scanners (e.g. Docker Scout) match VEX on the product purl of the affected + package. Entries with no JAR (Solr-native CVEs) use the Solr product instead, + version-expanded from a closed range (via solr-versions.txt) or version-less + for an open lower bound. The Solr version range is preserved in status_notes. """ statements = [] for v in entries: @@ -343,20 +402,19 @@ def build_openvex(entries): if len(v['ids']) > 1: vulnerability['aliases'] = v['ids'][1:] - subcomponents = [jar_to_component(j) for j in v['jars']] - affected = expand_versions(v['versions']) - if affected: - products = [] - for ver in affected: - product = {'@id': 'pkg:maven/org.apache.solr/solr-core@%s' % ver} - if subcomponents: - product['subcomponents'] = subcomponents - products.append(product) + # Scanners (e.g. Docker Scout) match VEX statements on the product purl, + # so the vulnerable JAR(s) are the products. For an entry with no JAR + # (e.g. a Solr-native CVE), the product is Solr itself: a versioned purl + # per affected release when the range is closed, else version-less. The + # human-readable Solr version range is carried in status_notes below. + if v['jars']: + products = jar_products(v['jars'], v['versions']) else: - product = {'@id': 'pkg:maven/org.apache.solr/solr-core'} - if subcomponents: - product['subcomponents'] = subcomponents - products = [product] + affected = expand_versions(v['versions']) + if affected: + products = [{'@id': 'pkg:maven/org.apache.solr/solr-core@%s' % ver} for ver in affected] + else: + products = [{'@id': 'pkg:maven/org.apache.solr/solr-core'}] statement = { 'vulnerability': vulnerability, @@ -395,7 +453,6 @@ def build_openvex(entries): 'statements': statements, } - def generator_initialized(generator): # The dependency-CVE table (security-dependency-cves.html) lists the entries # that declare vulnerable JARs, in all states (including exploitable). From 481d358a57700e27841f76cc9aef419acf0b80df Mon Sep 17 00:00:00 2001 From: Eric Pugh Date: Sat, 18 Jul 2026 07:33:13 -0300 Subject: [PATCH 4/8] Document how to use vex files with docker scout command. --- content/pages/security-dependency-cves.md | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/content/pages/security-dependency-cves.md b/content/pages/security-dependency-cves.md index 0a009752b..c2e3b8934 100644 --- a/content/pages/security-dependency-cves.md +++ b/content/pages/security-dependency-cves.md @@ -13,12 +13,27 @@ VEX is an open standard that lets vendors state explicitly whether a CVE applies and why. A number of formats are under active development, including [CycloneDX](https://cyclonedx.org/capabilities/vex/) and [CSAF](https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/prose/csaf-v2-editor-draft.md#45-profile-5-vex). -We currently publish in CycloneDX 1.6 JSON format. +We publish this assessment in both **CycloneDX 1.6** and **OpenVEX** JSON formats (download links below). If your scanner supports VEX, download the file below and point your scanner at it to automatically suppress known non-applicable findings. If your scanner does not yet support VEX, you can use the table on this page to manually triage flagged CVEs. +For example, [Docker Scout](https://docs.docker.com/scout/) can apply the OpenVEX file when scanning +an official Solr image: + +```bash +# Download the OpenVEX file, then have Docker Scout apply it to a scan. +curl -sO https://solr.apache.org/solr.openvex.json +docker scout cves solr:9.9.0 --vex-location solr.openvex.json --vex-author '.*' +``` + +CVEs marked `not_affected` are then dropped from the results, while those marked `affected` remain. +(Solr's VEX is authored by the Apache Solr project, so `--vex-author '.*'` is required — by default +Docker Scout only trusts VEX statements authored by `*@docker.com`.) + + + We encourage feedback on VEX and tool support — join the discussion at [security-discuss@community.apache.org](mailto:security-discuss@community.apache.org) or contact [security@apache.org](mailto:security@apache.org). From 358e841e9477535e234f86cee114454294272335 Mon Sep 17 00:00:00 2001 From: Eric Pugh Date: Sat, 18 Jul 2026 10:09:39 -0300 Subject: [PATCH 5/8] as part of adding more netty cves, we added more of these mappings. Ugh. --- plugins/vex/solr-dependency-versions.json | 107 ++++++++++++++++++++++ plugins/vex/vex.py | 7 ++ 2 files changed, 114 insertions(+) diff --git a/plugins/vex/solr-dependency-versions.json b/plugins/vex/solr-dependency-versions.json index 67770cab4..eea6d9009 100644 --- a/plugins/vex/solr-dependency-versions.json +++ b/plugins/vex/solr-dependency-versions.json @@ -657,6 +657,113 @@ "8.8.0": "4.1.50.Final", "8.8.1": "4.1.50.Final" }, + "io.netty:netty-codec-http": { + "9.2.0": "4.1.89.Final", + "9.2.1": "4.1.89.Final", + "9.3.0": "4.1.93.Final", + "9.4.0": "4.1.99.Final", + "9.4.1": "4.1.104.Final", + "9.5.0": "4.1.104.Final", + "9.6.0": "4.1.108.Final", + "9.6.1": "4.1.108.Final", + "9.7.0": "4.1.111.Final", + "9.8.0": "4.1.114.Final", + "9.8.1": "4.1.114.Final", + "9.9.0": "4.1.114.Final", + "9.10.0": "4.2.6.Final", + "9.10.1": "4.2.6.Final", + "10.0.0": "4.2.6.Final" + }, + "io.netty:netty-codec-compression": { + "9.10.0": "4.2.6.Final", + "9.10.1": "4.2.6.Final", + "10.0.0": "4.2.6.Final" + }, + "io.netty:netty-codec-http2": { + "9.2.0": "4.1.89.Final", + "9.2.1": "4.1.89.Final", + "9.3.0": "4.1.93.Final", + "9.4.0": "4.1.99.Final", + "9.4.1": "4.1.104.Final", + "9.5.0": "4.1.104.Final", + "9.6.0": "4.1.108.Final", + "9.6.1": "4.1.108.Final", + "9.7.0": "4.1.111.Final", + "9.8.0": "4.1.114.Final", + "9.8.1": "4.1.114.Final", + "9.9.0": "4.1.114.Final", + "9.10.0": "4.2.6.Final", + "9.10.1": "4.2.6.Final", + "10.0.0": "4.2.6.Final" + }, + "io.netty:netty-handler": { + "9.2.0": "4.1.89.Final", + "9.2.1": "4.1.89.Final", + "9.3.0": "4.1.93.Final", + "9.4.0": "4.1.99.Final", + "9.4.1": "4.1.104.Final", + "9.5.0": "4.1.104.Final", + "9.6.0": "4.1.108.Final", + "9.6.1": "4.1.108.Final", + "9.7.0": "4.1.111.Final", + "9.8.0": "4.1.114.Final", + "9.8.1": "4.1.114.Final", + "9.9.0": "4.1.114.Final", + "9.10.0": "4.2.6.Final", + "9.10.1": "4.2.6.Final", + "10.0.0": "4.2.6.Final" + }, + "io.netty:netty-handler-proxy": { + "9.2.0": "4.1.89.Final", + "9.2.1": "4.1.89.Final", + "9.3.0": "4.1.93.Final", + "9.4.0": "4.1.99.Final", + "9.4.1": "4.1.104.Final", + "9.5.0": "4.1.104.Final", + "9.6.0": "4.1.108.Final", + "9.6.1": "4.1.108.Final", + "9.7.0": "4.1.111.Final", + "9.8.0": "4.1.114.Final", + "9.8.1": "4.1.114.Final", + "9.9.0": "4.1.114.Final", + "9.10.0": "4.2.6.Final", + "9.10.1": "4.2.6.Final", + "10.0.0": "4.2.6.Final" + }, + "io.netty:netty-transport-native-unix-common": { + "9.2.0": "4.1.89.Final", + "9.2.1": "4.1.89.Final", + "9.3.0": "4.1.93.Final", + "9.4.0": "4.1.99.Final", + "9.4.1": "4.1.104.Final", + "9.5.0": "4.1.104.Final", + "9.6.0": "4.1.108.Final", + "9.6.1": "4.1.108.Final", + "9.7.0": "4.1.111.Final", + "9.8.0": "4.1.114.Final", + "9.8.1": "4.1.114.Final", + "9.9.0": "4.1.114.Final", + "9.10.0": "4.2.6.Final", + "9.10.1": "4.2.6.Final", + "10.0.0": "4.2.6.Final" + }, + "io.netty:netty-transport-native-epoll": { + "9.2.0": "4.1.89.Final", + "9.2.1": "4.1.89.Final", + "9.3.0": "4.1.93.Final", + "9.4.0": "4.1.99.Final", + "9.4.1": "4.1.104.Final", + "9.5.0": "4.1.104.Final", + "9.6.0": "4.1.108.Final", + "9.6.1": "4.1.108.Final", + "9.7.0": "4.1.111.Final", + "9.8.0": "4.1.114.Final", + "9.8.1": "4.1.114.Final", + "9.9.0": "4.1.114.Final", + "9.10.0": "4.2.6.Final", + "9.10.1": "4.2.6.Final", + "10.0.0": "4.2.6.Final" + }, "junit:junit": { "10.0.0": "4.13.2", "3.6.0": "4.10", diff --git a/plugins/vex/vex.py b/plugins/vex/vex.py index 37b6c7c87..93919e351 100644 --- a/plugins/vex/vex.py +++ b/plugins/vex/vex.py @@ -208,6 +208,13 @@ def pelican_init(pelicanobj): 'slf4j-api': 'org.slf4j', 'icu4j': 'com.ibm.icu', 'netty-all': 'io.netty', + 'netty-codec-compression': 'io.netty', + 'netty-codec-http': 'io.netty', + 'netty-codec-http2': 'io.netty', + 'netty-handler': 'io.netty', + 'netty-handler-proxy': 'io.netty', + 'netty-transport-native-epoll': 'io.netty', + 'netty-transport-native-unix-common': 'io.netty', 'hadoop-auth': 'org.apache.hadoop', 'hadoop-common': 'org.apache.hadoop', 'log4j-core': 'org.apache.logging.log4j', From 55d1658043e32d0579dee0f63a61b5bd7e31b2af Mon Sep 17 00:00:00 2001 From: Eric Pugh Date: Sun, 19 Jul 2026 18:20:49 -0300 Subject: [PATCH 6/8] Eliminate hardcoded JAR_GROUPS by using the current generated file. --- plugins/vex/solr-dependency-versions.json | 2 + plugins/vex/vex.py | 79 +++++++---------------- 2 files changed, 24 insertions(+), 57 deletions(-) diff --git a/plugins/vex/solr-dependency-versions.json b/plugins/vex/solr-dependency-versions.json index eea6d9009..ac7ab4fef 100644 --- a/plugins/vex/solr-dependency-versions.json +++ b/plugins/vex/solr-dependency-versions.json @@ -997,6 +997,7 @@ "9.8.1": "1.37.0", "9.9.0": "1.37.0" }, + "org.apache.calcite:calcite": {}, "org.apache.commons:commons-compress": { "10.0.0": "1.28.0", "3.6.0": "1.3", @@ -1648,6 +1649,7 @@ "9.8.1": "2.21.0", "9.9.0": "2.21.0" }, + "org.apache.lucene:lucene-analyzers-icu": {}, "org.apache.opennlp:opennlp-tools": { "10.0.0": "2.5.6", "7.3.0": "1.8.3", diff --git a/plugins/vex/vex.py b/plugins/vex/vex.py index 93919e351..15c03f798 100644 --- a/plugins/vex/vex.py +++ b/plugins/vex/vex.py @@ -186,61 +186,6 @@ def pelican_init(pelicanobj): 'code_not_reachable': 'vulnerable_code_not_in_execute_path', } -# Maven groupIds for the artifacts our VEX entries reference, so a JAR name can -# be emitted as a proper purl subcomponent. Artifacts not listed here (or JARs -# whose version can't be parsed, e.g. "guava-*.jar") fall back to a bare @id. -JAR_GROUPS = { - 'opennlp-tools': 'org.apache.opennlp', - 'jetty-http': 'org.eclipse.jetty', - 'jetty-server': 'org.eclipse.jetty', - 'json-path': 'com.jayway.jsonpath', - 'zookeeper': 'org.apache.zookeeper', - 'xercesImpl': 'xerces', - 'protobuf-java': 'com.google.protobuf', - 'commons-beanutils': 'commons-beanutils', - 'commons-compress': 'org.apache.commons', - 'commons-configuration2': 'org.apache.commons', - 'commons-lang3': 'org.apache.commons', - 'commons-text': 'org.apache.commons', - 'dom4j': 'dom4j', - 'avatica-core': 'org.apache.calcite.avatica', - 'calcite': 'org.apache.calcite', - 'slf4j-api': 'org.slf4j', - 'icu4j': 'com.ibm.icu', - 'netty-all': 'io.netty', - 'netty-codec-compression': 'io.netty', - 'netty-codec-http': 'io.netty', - 'netty-codec-http2': 'io.netty', - 'netty-handler': 'io.netty', - 'netty-handler-proxy': 'io.netty', - 'netty-transport-native-epoll': 'io.netty', - 'netty-transport-native-unix-common': 'io.netty', - 'hadoop-auth': 'org.apache.hadoop', - 'hadoop-common': 'org.apache.hadoop', - 'log4j-core': 'org.apache.logging.log4j', - 'log4j-1.2-api': 'org.apache.logging.log4j', - 'log4j-layout-template-json': 'org.apache.logging.log4j', - 'lucene-analyzers-icu': 'org.apache.lucene', - 'vorbis-java-tika': 'org.gagravarr', - 'velocity-tools': 'org.apache.velocity', - 'org.restlet': 'org.restlet.jee', - 'simple-xml': 'org.simpleframework', - 'carrot2-guava': 'org.carrot2.shaded', - 'junit': 'junit', - 'guava': 'com.google.guava', - 'jackson-databind': 'com.fasterxml.jackson.core', - 'jdom': 'org.jdom', - 'jdom2': 'org.jdom', - 'tika-core': 'org.apache.tika', - 'calcite': 'org.apache.calcite', - 'calcite-core': 'org.apache.calcite', - 'jcl-over-slf4j': 'org.slf4j', - 'jul-to-slf4j': 'org.slf4j', - 'hadoop-hdfs': 'org.apache.hadoop', - 'hadoop-client': 'org.apache.hadoop', - 'simple-xml': 'org.simpleframework', -} - # Split a JAR name into (artifact, version). Standard `artifact-version.jar` uses # a greedy artifact so the version is the *last* "-" segment (handles # artifacts that themselves contain version-like parts, e.g. `log4j-1.2-api`). @@ -256,7 +201,7 @@ def jar_to_component(jar): match = _JAR_HYPHEN_RE.match(jar) or _JAR_DOT_RE.match(jar) if match: artifact, version = match.group(1), match.group(2) - group = JAR_GROUPS.get(artifact) + group = jar_groups().get(artifact) if group: return {'@id': 'pkg:maven/%s/%s@%s' % (group, artifact, version)} return {'@id': jar} @@ -270,7 +215,7 @@ def jar_coordinates(jar): if not match: return None artifact = match.group(1) - group = JAR_GROUPS.get(artifact) + group = jar_groups().get(artifact) return (group, artifact) if group else None @@ -287,6 +232,26 @@ def dep_versions(): return _dep_versions +_jar_groups = None + + +def jar_groups(): + """{artifact: groupId} for every artifact whose Maven coordinates are known, + so a JAR name can be emitted as a proper purl subcomponent. Derived from + solr-dependency-versions.json's 'group:artifact' keys (the authoritative + source, since Solr's own build pins those coordinates — an artifact with no + known per-release version history is still listed there with an empty map). + Artifacts not tracked there (or JARs whose version can't be parsed, e.g. + "guava-*.jar") fall back to a bare @id.""" + global _jar_groups + if _jar_groups is None: + _jar_groups = {} + for key in dep_versions(): + group, artifact = key.split(':', 1) + _jar_groups[artifact] = group + return _jar_groups + + # Authoritative list of every released Solr version, used to expand the # free-form `versions` ranges into concrete per-version purls for OpenVEX. VERSIONS_FILE = Path(__file__).resolve().parent / 'solr-versions.txt' From 9fdcc3ad8b1bfe7573da40b96df324dcf45e7b7f Mon Sep 17 00:00:00 2001 From: Eric Pugh Date: Sun, 19 Jul 2026 18:33:41 -0300 Subject: [PATCH 7/8] modules: solr-core or solr-solrj support. Omitting means solr-core. --- plugins/vex/schema/vex_article.schema.yaml | 9 +++++++++ plugins/vex/vex.py | 11 +++++++---- 2 files changed, 16 insertions(+), 4 deletions(-) diff --git a/plugins/vex/schema/vex_article.schema.yaml b/plugins/vex/schema/vex_article.schema.yaml index 4bd124975..7e0a05791 100644 --- a/plugins/vex/schema/vex_article.schema.yaml +++ b/plugins/vex/schema/vex_article.schema.yaml @@ -32,6 +32,15 @@ properties: items: type: string description: Vulnerable JAR files (present for dependency CVEs). + modules: + type: array + minItems: 1 + items: + type: string + description: | + Solr Maven artifactIds (under org.apache.solr) this Solr-native CVE affects, + e.g. "solr-solrj". Only meaningful when 'jars' is absent. Defaults to + ["solr-core"] when omitted. analysis: "$ref": "bom-1.6.schema.json#/definitions/vulnerability/properties/analysis" description: | diff --git a/plugins/vex/vex.py b/plugins/vex/vex.py index 15c03f798..e5840366a 100644 --- a/plugins/vex/vex.py +++ b/plugins/vex/vex.py @@ -92,6 +92,7 @@ def read_vex_articles(content_path): 'analysis': analysis, 'versions': meta.get('versions', ''), 'jars': meta.get('jars', []), + 'modules': meta.get('modules', ['solr-core']), 'title': meta.get('title', ''), # Anchor on vex.html (matches each VEX article's slug, see set_vex_slug). 'anchor': vex_anchor(path), @@ -376,17 +377,19 @@ def build_openvex(entries): # Scanners (e.g. Docker Scout) match VEX statements on the product purl, # so the vulnerable JAR(s) are the products. For an entry with no JAR - # (e.g. a Solr-native CVE), the product is Solr itself: a versioned purl - # per affected release when the range is closed, else version-less. The + # (e.g. a Solr-native CVE), the product is the affected Solr module(s) + # ('modules' front matter, defaulting to solr-core): a versioned purl per + # affected release when the range is closed, else version-less. The # human-readable Solr version range is carried in status_notes below. if v['jars']: products = jar_products(v['jars'], v['versions']) else: affected = expand_versions(v['versions']) if affected: - products = [{'@id': 'pkg:maven/org.apache.solr/solr-core@%s' % ver} for ver in affected] + products = [{'@id': 'pkg:maven/org.apache.solr/%s@%s' % (module, ver)} + for module in v['modules'] for ver in affected] else: - products = [{'@id': 'pkg:maven/org.apache.solr/solr-core'}] + products = [{'@id': 'pkg:maven/org.apache.solr/%s' % module} for module in v['modules']] statement = { 'vulnerability': vulnerability, From 2301713308cdb8b731df809633dafbe357495424 Mon Sep 17 00:00:00 2001 From: Eric Pugh Date: Tue, 21 Jul 2026 18:09:47 -0300 Subject: [PATCH 8/8] Demonstate using 'syft' tool to generate sbom that populates the solr version mapping file. --- build.sh | 22 +++ plugins/vex/solr-dependency-versions.json | 191 ++++++++++++++++-- plugins/vex/update_dependency_versions.py | 224 ++++++++++++++++++++++ 3 files changed, 424 insertions(+), 13 deletions(-) create mode 100644 plugins/vex/update_dependency_versions.py diff --git a/build.sh b/build.sh index 3a6cd4435..8504e1dda 100755 --- a/build.sh +++ b/build.sh @@ -25,6 +25,7 @@ DOCKER_CMD="docker run --rm -ti -w /work -p 8000:8000 -v $(pwd):/work $SOLR_LOCA unset SERVE unset BUILD unset LOCK +unset UPDATE_DEPS PELICAN_CMD="pelican content -o output" export SITEURL="https://solr.apache.org/" @@ -35,6 +36,7 @@ OPTIONS=( "l:live:Live build and reload source changes on localhost:8000" "b:build:Force rebuild of the local Docker image" ":lock:Regenerate requirements.txt from requirements.in (use with -b to also rebuild image)" + ":update-deps:Regenerate solr-dependency-versions.json (needs python3; pass versions after --, default is all)" "h:help:Show this help message" ":pelican-help:Show all options accepted by Pelican" ) @@ -83,6 +85,20 @@ function regen_lockfile { echo "requirements.txt updated." } +function update_dependency_versions { + if ! command -v python3 >/dev/null 2>&1; then + echo "ERROR: --update-deps requires python3 on the host (in addition to Docker)." >&2 + exit 2 + fi + echo "Downloading and syft-scanning each tracked Solr release's binary distribution..." + echo "(Pulls the 'anchore/syft:latest' image on first run; a full run downloads every" + echo " release's tarball, so it's slow and bandwidth-heavy. Pass specific versions" + echo " and/or flags (--slim, --verbose) after --, e.g.:" + echo " ./build.sh --update-deps -- --slim 10.0.0" + echo " See 'python3 plugins/vex/update_dependency_versions.py --help' for details.)" + python3 plugins/vex/update_dependency_versions.py "$@" +} + function ensure_image { if ! docker inspect $SOLR_LOCAL_PELICAN_IMAGE >/dev/null 2>&1 then @@ -135,6 +151,7 @@ function handle_opt { -l|--live) SERVE=true ;; -b|--build) BUILD=true ;; --lock) LOCK=true ;; + --update-deps) UPDATE_DEPS=true ;; -h|--help) usage; exit 0 ;; --pelican-help) ensure_image; $DOCKER_CMD pelican -h; exit 0 ;; --) return 1 ;; @@ -167,6 +184,11 @@ if [[ $LOCK ]]; then fi fi +if [[ $UPDATE_DEPS ]]; then + update_dependency_versions "$@" + exit 0 +fi + if [[ $BUILD ]]; then build_image else diff --git a/plugins/vex/solr-dependency-versions.json b/plugins/vex/solr-dependency-versions.json index ac7ab4fef..cad790463 100644 --- a/plugins/vex/solr-dependency-versions.json +++ b/plugins/vex/solr-dependency-versions.json @@ -201,7 +201,11 @@ "9.7.0": "33.1.0-jre", "9.8.0": "33.1.0-jre", "9.8.1": "33.1.0-jre", - "9.9.0": "33.1.0-jre" + "9.9.0": "33.1.0-jre", + "3.6.0": "r05", + "3.6.1": "r05", + "3.6.2": "r05", + "4.0.0": "10.0.1" }, "com.google.protobuf:protobuf-java": { "10.0.0": "3.25.8", @@ -530,7 +534,16 @@ "9.10.1": "1.9.4", "9.8.0": "1.9.4", "9.8.1": "1.9.4", - "9.9.0": "1.9.4" + "9.9.0": "1.9.4", + "9.0.0": "1.9.4", + "9.1.0": "1.9.4", + "9.1.1": "1.9.4", + "9.2.0": "1.9.4", + "9.2.1": "1.9.4", + "9.3.0": "1.9.4", + "9.4.0": "1.9.4", + "9.4.1": "1.9.4", + "9.5.0": "1.9.4" }, "dom4j:dom4j": { "3.6.0": "1.6.1", @@ -711,7 +724,22 @@ "9.9.0": "4.1.114.Final", "9.10.0": "4.2.6.Final", "9.10.1": "4.2.6.Final", - "10.0.0": "4.2.6.Final" + "10.0.0": "4.2.6.Final", + "8.3.0": "4.1.29.Final", + "8.3.1": "4.1.29.Final", + "8.4.0": "4.1.29.Final", + "8.4.1": "4.1.29.Final", + "8.5.0": "4.1.29.Final", + "8.5.1": "4.1.29.Final", + "8.5.2": "4.1.29.Final", + "8.6.0": "4.1.47.Final", + "8.6.1": "4.1.47.Final", + "8.6.2": "4.1.47.Final", + "8.6.3": "4.1.47.Final", + "8.8.1": "4.1.50.Final", + "9.0.0": "4.1.68.Final", + "9.1.0": "4.1.82.Final", + "9.1.1": "4.1.82.Final" }, "io.netty:netty-handler-proxy": { "9.2.0": "4.1.89.Final", @@ -745,7 +773,22 @@ "9.9.0": "4.1.114.Final", "9.10.0": "4.2.6.Final", "9.10.1": "4.2.6.Final", - "10.0.0": "4.2.6.Final" + "10.0.0": "4.2.6.Final", + "8.3.0": "4.1.29.Final", + "8.3.1": "4.1.29.Final", + "8.4.0": "4.1.29.Final", + "8.4.1": "4.1.29.Final", + "8.5.0": "4.1.29.Final", + "8.5.1": "4.1.29.Final", + "8.5.2": "4.1.29.Final", + "8.6.0": "4.1.47.Final", + "8.6.1": "4.1.47.Final", + "8.6.2": "4.1.47.Final", + "8.6.3": "4.1.47.Final", + "8.8.1": "4.1.50.Final", + "9.0.0": "4.1.68.Final", + "9.1.0": "4.1.82.Final", + "9.1.1": "4.1.82.Final" }, "io.netty:netty-transport-native-epoll": { "9.2.0": "4.1.89.Final", @@ -762,7 +805,22 @@ "9.9.0": "4.1.114.Final", "9.10.0": "4.2.6.Final", "9.10.1": "4.2.6.Final", - "10.0.0": "4.2.6.Final" + "10.0.0": "4.2.6.Final", + "8.3.0": "4.1.29.Final", + "8.3.1": "4.1.29.Final", + "8.4.0": "4.1.29.Final", + "8.4.1": "4.1.29.Final", + "8.5.0": "4.1.29.Final", + "8.5.1": "4.1.29.Final", + "8.5.2": "4.1.29.Final", + "8.6.0": "4.1.47.Final", + "8.6.1": "4.1.47.Final", + "8.6.2": "4.1.47.Final", + "8.6.3": "4.1.47.Final", + "8.8.1": "4.1.50.Final", + "9.0.0": "4.1.68.Final", + "9.1.0": "4.1.82.Final", + "9.1.1": "4.1.82.Final" }, "junit:junit": { "10.0.0": "4.13.2", @@ -873,7 +931,9 @@ "9.7.0": "4.13.2", "9.8.0": "4.13.2", "9.8.1": "4.13.2", - "9.9.0": "4.13.2" + "9.9.0": "4.13.2", + "1.3.0": "4.3", + "1.4.0": "4.3" }, "org.apache.calcite.avatica:avatica-core": { "10.0.0": "1.25.0", @@ -1107,7 +1167,10 @@ "9.7.0": "1.26.1", "9.8.0": "1.26.1", "9.8.1": "1.26.1", - "9.9.0": "1.26.1" + "9.9.0": "1.26.1", + "1.4.0": "1.0", + "3.4.0": "1.1", + "3.5.0": "1.2" }, "org.apache.commons:commons-configuration2": { "8.0.0": "2.1.1", @@ -1649,7 +1712,84 @@ "9.8.1": "2.21.0", "9.9.0": "2.21.0" }, - "org.apache.lucene:lucene-analyzers-icu": {}, + "org.apache.lucene:lucene-analyzers-icu": { + "4.0.0": "4.0.0", + "4.1.0": "4.1.0", + "4.2.0": "4.2.0", + "4.2.1": "4.2.1", + "4.3.0": "4.3.0", + "4.3.1": "4.3.1", + "4.4.0": "4.4.0", + "4.5.0": "4.5.0", + "4.5.1": "4.5.1", + "4.6.0": "4.6.0", + "4.6.1": "4.6.1", + "4.7.0": "4.7.0", + "4.7.1": "4.7.1", + "4.7.2": "4.7.2", + "4.8.0": "4.8.0", + "4.8.1": "4.8.1", + "4.9.0": "4.9.0", + "4.10.0": "4.10.0", + "4.10.1": "4.10.1", + "4.10.2": "4.10.2", + "4.10.3": "4.10.3", + "5.1.0": "5.1.0", + "5.2.0": "5.2.0", + "5.3.0": "5.3.0", + "5.3.1": "5.3.1", + "5.3.2": "5.3.2", + "5.4.0": "5.4.0", + "5.4.1": "5.4.1", + "5.5.0": "5.5.0", + "5.5.1": "5.5.1", + "5.5.2": "5.5.2", + "5.5.3": "5.5.3", + "5.5.4": "5.5.4", + "5.5.5": "5.5.5", + "6.0.0": "6.0.0", + "6.0.1": "6.0.1", + "6.1.0": "6.1.0", + "6.2.0": "6.2.0", + "6.2.1": "6.2.1", + "6.3.0": "6.3.0", + "6.4.0": "6.4.0", + "6.4.1": "6.4.1", + "6.4.2": "6.4.2", + "6.5.0": "6.5.0", + "6.5.1": "6.5.1", + "6.6.5": "6.6.5", + "6.6.6": "6.6.6", + "7.0.0": "7.0.0", + "7.0.1": "7.0.1", + "7.1.0": "7.1.0", + "7.2.0": "7.2.0", + "7.2.1": "7.2.1", + "7.3.0": "7.3.0", + "7.3.1": "7.3.1", + "7.5.0": "7.5.0", + "7.6.0": "7.6.0", + "7.7.0": "7.7.0", + "7.7.1": "7.7.1", + "7.7.2": "7.7.2", + "7.7.3": "7.7.3", + "8.0.0": "8.0.0", + "8.1.0": "8.1.0", + "8.1.1": "8.1.1", + "8.2.0": "8.2.0", + "8.3.0": "8.3.0", + "8.3.1": "8.3.1", + "8.4.0": "8.4.0", + "8.4.1": "8.4.1", + "8.5.0": "8.5.0", + "8.5.1": "8.5.1", + "8.5.2": "8.5.2", + "8.6.0": "8.6.0", + "8.6.1": "8.6.1", + "8.6.2": "8.6.2", + "8.6.3": "8.6.3", + "8.8.1": "8.8.1" + }, "org.apache.opennlp:opennlp-tools": { "10.0.0": "2.5.6", "7.3.0": "1.8.3", @@ -1806,7 +1946,10 @@ "9.7.0": "1.28.5", "9.8.0": "1.28.5", "9.8.1": "1.28.5", - "9.9.0": "1.28.5" + "9.9.0": "1.28.5", + "1.4.0": "0.4", + "3.4.0": "0.8", + "3.5.0": "0.10" }, "org.apache.velocity:velocity-tools": { "3.6.0": "2.0", @@ -1882,7 +2025,10 @@ "7.7.1": "2.0", "7.7.2": "2.0", "7.7.3": "2.0", - "8.0.0": "2.0" + "8.0.0": "2.0", + "1.4.0": "2.0-beta3", + "3.4.0": "2.0-beta3", + "3.5.0": "2.0" }, "org.apache.zookeeper:zookeeper": { "10.0.0": "3.9.4", @@ -2646,7 +2792,20 @@ "8.0.0": "2.7.1", "8.1.0": "2.7.1", "8.1.1": "2.7.1", - "8.2.0": "2.7.1" + "8.2.0": "2.7.1", + "7.7.3": "2.7.1", + "8.3.0": "2.7.1", + "8.3.1": "2.7.1", + "8.4.0": "2.7.1", + "8.4.1": "2.7.1", + "8.5.0": "2.7.1", + "8.5.1": "2.7.1", + "8.5.2": "2.7.1", + "8.6.0": "2.7.1", + "8.6.1": "2.7.1", + "8.6.2": "2.7.1", + "8.6.3": "2.7.1", + "8.8.1": "2.7.1" }, "org.slf4j:jcl-over-slf4j": { "10.0.0": "2.0.17", @@ -2757,7 +2916,10 @@ "9.7.0": "2.0.13", "9.8.0": "2.0.13", "9.8.1": "2.0.13", - "9.9.0": "2.0.13" + "9.9.0": "2.0.13", + "1.4.0": "1.5.5", + "3.4.0": "1.6.1", + "3.5.0": "1.6.1" }, "org.slf4j:jul-to-slf4j": { "10.0.0": "2.0.17", @@ -2972,7 +3134,10 @@ "9.7.0": "2.0.13", "9.8.0": "2.0.13", "9.8.1": "2.0.13", - "9.9.0": "2.0.13" + "9.9.0": "2.0.13", + "1.4.0": "1.5.5", + "3.4.0": "1.5.6", + "3.5.0": "1.6.1" }, "xerces:xercesImpl": { "3.6.0": "2.9.1", diff --git a/plugins/vex/update_dependency_versions.py b/plugins/vex/update_dependency_versions.py new file mode 100644 index 000000000..f6cb7114d --- /dev/null +++ b/plugins/vex/update_dependency_versions.py @@ -0,0 +1,224 @@ +#!/usr/bin/env python3 +"""Regenerate solr-dependency-versions.json from a real syft SBOM scan of each +tracked Solr release's actual binary distribution, instead of resolving a +declared Maven dependency graph. A declared graph misses anything Solr bundles +at packaging time (e.g. its own Jetty server) and can conflate a tracked +artifact with an unrelated same-named dependency pulled in by some other, +optional module -- syft instead reads the real jars on disk. + +Usage: + python3 plugins/vex/update_dependency_versions.py [VERSION ...] + +With no arguments, every version in solr-versions.txt is (re)scanned, which +downloads and unpacks each release's full binary distribution (tens to a few +hundred MB each) -- expect a full run to take a long time and a lot of +bandwidth, since archive.apache.org (the only host with the complete release +history) serves archived releases slowly. Pass one or more specific versions +(e.g. just-released ones) to only refresh those, and/or --slim to scan the +much smaller "-slim" distribution (5-6x less data, 9.x+ only) at the cost of +missing dependencies that only live in optional modules (Hadoop, Tika, etc). + +Only already-tracked dependencies (existing keys in solr-dependency-versions.json) +are touched, and only to fill in a missing (dependency, Solr version) entry -- +an existing value is never overwritten. A resolved value that disagrees with +what's on file is reported as a conflict for a human to look into rather than +applied. Newly-seen third-party dependencies that aren't tracked yet are also +reported, for a human to decide whether to start tracking them. +""" +import argparse +import json +import re +import shutil +import subprocess +import sys +import tarfile +import tempfile +import urllib.error +import urllib.request +from pathlib import Path + +VEX_DIR = Path(__file__).resolve().parent +REPO_ROOT = VEX_DIR.parent.parent +VERSIONS_FILE = VEX_DIR / 'solr-versions.txt' +DEP_VERSIONS_FILE = VEX_DIR / 'solr-dependency-versions.json' +SYFT_IMAGE = 'anchore/syft:latest' + +# First-party groups: never worth tracking as a "third-party dependency". +EXCLUDED_GROUPS = {'org.apache.solr', 'org.apache.lucene'} + +# Candidate (base URL, filename) templates to try, in order, covering Solr's +# release-hosting history: the current standalone repo (9.0+), the older +# combined Lucene/Solr repo (~3.1-8.x), and that repo's older "apache-solr-" +# filename prefix (pre ~4.3-ish). The first template that downloads +# successfully is used. +URL_TEMPLATES = [ + 'https://archive.apache.org/dist/solr/solr/{v}/solr-{v}.tgz', + 'https://archive.apache.org/dist/lucene/solr/{v}/solr-{v}.tgz', + 'https://archive.apache.org/dist/lucene/solr/{v}/apache-solr-{v}.tgz', +] + +# The much smaller "-slim" distribution (9.x+ only) excludes optional modules +# (Hadoop, Tika/extraction, etc.), so any dependency that only lives in one of +# those won't be found this way -- it'll just stay whatever it already is. +SLIM_URL_TEMPLATES = [ + 'https://archive.apache.org/dist/solr/solr/{v}/solr-{v}-slim.tgz', +] + + +def download_distribution(version, dest, slim=False): + """Download the first resolvable release tarball for `version` into `dest`. + Returns True on success, False if no URL template resolved.""" + templates = (SLIM_URL_TEMPLATES + URL_TEMPLATES) if slim else URL_TEMPLATES + for template in templates: + url = template.format(v=version) + try: + with urllib.request.urlopen(url, timeout=60) as resp, open(dest, 'wb') as out: + shutil.copyfileobj(resp, out) + return True + except (urllib.error.HTTPError, urllib.error.URLError, TimeoutError): + dest.unlink(missing_ok=True) + continue + return False + + +def run_syft(extracted_dir): + """Run syft against the extracted distribution directory, returning the + parsed CycloneDX JSON document, or None on failure.""" + try: + result = subprocess.run( + ['docker', 'run', '--rm', '-v', f'{extracted_dir}:/work', + SYFT_IMAGE, '/work', '-o', 'cyclonedx-json'], + capture_output=True, text=True, timeout=300, + ) + except FileNotFoundError: + sys.exit('ERROR: docker is required to run syft (see README.md for setup).') + if result.returncode != 0 or not result.stdout.strip(): + return None + try: + return json.loads(result.stdout) + except json.JSONDecodeError: + return None + + +PURL_RE = re.compile(r'^pkg:maven/([^/]+)/([^@]+)@([^?]+)') + + +def iter_maven_packages(sbom): + """Yield (group, artifact, version) for every Maven-purl component in a + syft CycloneDX SBOM.""" + for component in sbom.get('components', []): + m = PURL_RE.match(component.get('purl', '')) + if m: + yield m.groups() + + +def scan_version(version, work_dir, slim=False): + """Download, extract, and syft-scan `version`'s binary distribution under + `work_dir`. Returns the parsed CycloneDX SBOM, or None if the release + couldn't be downloaded, extracted, or scanned.""" + tarball = work_dir / 'dist.tgz' + if not download_distribution(version, tarball, slim=slim): + print(f' no release tarball found for {version}, skipping', file=sys.stderr) + return None + extract_dir = work_dir / 'extracted' + extract_dir.mkdir() + try: + with tarfile.open(tarball) as tf: + try: + tf.extractall(extract_dir, filter='data') + except TypeError: + tf.extractall(extract_dir) # Python < 3.12 has no `filter` kwarg + except tarfile.TarError as e: + print(f' failed to extract {version}: {e}', file=sys.stderr) + return None + finally: + tarball.unlink(missing_ok=True) # reclaim disk before/while syft runs + sbom = run_syft(extract_dir) + if sbom is None: + print(f' syft scan failed for {version}', file=sys.stderr) + return sbom + + +def main(): + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument('versions', nargs='*', + help='Specific Solr versions to refresh (default: all)') + parser.add_argument('--verbose', action='store_true', + help='List every untracked dependency seen, not just the count') + parser.add_argument('--slim', action='store_true', + help='Scan the smaller "-slim" distribution (9.x+ only, falls back to ' + 'full) instead of the full one. Faster, but misses dependencies ' + 'that only live in optional modules (Hadoop, Tika/extraction, etc).') + args = parser.parse_args() + + all_versions = [ + ln.strip() for ln in VERSIONS_FILE.read_text().splitlines() + if ln.strip() and not ln.strip().startswith('#') + ] + versions = args.versions or all_versions + unknown = sorted(set(versions) - set(all_versions)) + if unknown: + sys.exit(f'Unknown Solr version(s), not in {VERSIONS_FILE.name}: {", ".join(unknown)}') + + dep_versions = json.loads(DEP_VERSIONS_FILE.read_text()) + tracked = set(dep_versions) + new_candidates = {} + conflicts = [] + skipped = [] + added = 0 + + for i, version in enumerate(versions, 1): + print(f'[{i}/{len(versions)}] Solr {version}...', file=sys.stderr) + with tempfile.TemporaryDirectory() as tmp: + sbom = scan_version(version, Path(tmp), slim=args.slim) + if sbom is None: + skipped.append(version) + continue + + found_this_version = {} + for group, artifact, dep_version in iter_maven_packages(sbom): + key = f'{group}:{artifact}' + if key in tracked: + found_this_version.setdefault(key, dep_version) + elif group not in EXCLUDED_GROUPS: + new_candidates.setdefault(key, set()).add(version) + + # Only fill genuine gaps -- never overwrite an existing value. A + # resolved value that disagrees with what's already on file is + # surfaced as a conflict for a human to look into, never applied + # automatically. + for key, dep_version in found_this_version.items(): + existing = dep_versions.setdefault(key, {}) + if version not in existing: + existing[version] = dep_version + added += 1 + elif existing[version] != dep_version: + conflicts.append((key, version, existing[version], dep_version)) + + DEP_VERSIONS_FILE.write_text(json.dumps(dep_versions, indent=2) + '\n') + + print(f'\nUpdated {DEP_VERSIONS_FILE.relative_to(REPO_ROOT)}: filled {added} missing ' + f'(dependency, version) entries.', file=sys.stderr) + + if skipped: + print(f'\n{len(skipped)} version(s) skipped (no release tarball found, or ' + f'extraction/scan failed): {", ".join(skipped)}', file=sys.stderr) + + if conflicts: + print(f'\n{len(conflicts)} resolved value(s) disagree with what is already on file ' + f'-- left UNCHANGED, please review by hand:', file=sys.stderr) + for key, version, existing_value, resolved_value in conflicts: + print(f' {key} @ {version}: on file = {existing_value!r}, ' + f'resolved = {resolved_value!r}', file=sys.stderr) + + if new_candidates: + print(f'\n{len(new_candidates)} dependencies seen but not yet tracked ' + f'(rerun with --verbose to list them; add to solr-dependency-versions.json ' + f'if one becomes security-relevant).', file=sys.stderr) + if args.verbose: + for key in sorted(new_candidates): + print(f' {key}', file=sys.stderr) + + +if __name__ == '__main__': + main()