Copilot commented on code in PR #205: URL: https://github.com/apache/solr-site/pull/205#discussion_r3607269756
########## content/solr/vex/2026-06-18-cve-2026-5795.md: ########## @@ -2,7 +2,7 @@ cve: CVE-2026-5795 category: - solr/vex -versions: "≤ 9.x" +versions: "7.3.0-10.0.0" jars: - jetty-server-10.0.26.jar Review Comment: The `jars` entry is pinned to `jetty-server-10.0.26.jar`, but this VEX now claims the affected Solr range is 7.3.0–10.0.0 and the body notes different bundled Jetty versions across that range (9.4.x, 10.0.x, 12.0.27). Consider using a wildcard so the JAR identifier matches the full version range being described. ########## content/solr/vex/2026-06-18-cve-2026-2332.md: ########## @@ -2,7 +2,7 @@ cve: CVE-2026-2332 category: - solr/vex -versions: "≤ 9.x" +versions: "7.3.0-10.0.0" jars: - jetty-http-10.0.26.jar Review Comment: The `jars` entry is pinned to `jetty-http-10.0.26.jar`, but this VEX now claims the affected Solr range is 7.3.0–10.0.0 and the body notes different bundled Jetty versions across that range (9.4.x, 10.0.x, 12.0.27). Consider using a wildcard so the JAR identifier matches the full version range being described. ########## content/solr/vex/2026-05-04-cve-2026-42027.md: ########## @@ -2,7 +2,7 @@ cve: CVE-2026-42027 category: - solr/vex -versions: "< 10.1.0" +versions: "7.3.0-10.0.0" jars: - opennlp-tools-1.9.4.jar Review Comment: This entry says affected OpenNLP versions span 1.8.3 through 2.5.6 across Solr 7.3.0–10.0.0, but the `jars` list is pinned to a single version (`opennlp-tools-1.9.4.jar`). Using a wildcard would better match the stated affected range. ########## content/solr/vex/2025-08-02-cve-2024-7254.md: ########## @@ -3,9 +3,18 @@ cve: CVE-2024-7254 jira: SOLR-17833 category: - solr/vex -versions: "≤ 9.9.0" +versions: "4.4.0-9.9.0" +jars: + - protobuf-java-3.25.3.jar Review Comment: The body states Solr bundles affected `protobuf-java` versions ranging from 2.4.0a through 3.25.3 across Solr 4.4.0–9.9.0, but the `jars` list is pinned to `protobuf-java-3.25.3.jar`. Consider using a wildcard so the JAR identifier covers the full stated range. ########## content/solr/vex/2022-12-14-cve-2021-33813.md: ########## @@ -2,11 +2,18 @@ cve: CVE-2021-33813 category: - solr/vex -versions: "≤ 8.x" +versions: "3.6.0-8.8.1" jars: - - jdom-*.jar + - jdom-2.0.2.jar + - jdom2-2.0.6.jar Review Comment: The body says Solr shipped `jdom` 1.0 before upgrading to later JDOM versions, but the `jars` list no longer includes the `jdom` 1.0 JAR. Adding it would keep the front matter consistent with the narrative and the stated affected range. ########## content/solr/vex/2026-05-04-cve-2026-40682.md: ########## @@ -2,7 +2,7 @@ cve: CVE-2026-40682 category: - solr/vex -versions: "< 10.1.0" +versions: "7.3.0-10.0.0" jars: - opennlp-tools-1.9.4.jar Review Comment: This entry says affected OpenNLP versions span 1.8.3 through 2.5.6 across Solr 7.3.0–10.0.0, but the `jars` list is pinned to a single version (`opennlp-tools-1.9.4.jar`). Using a wildcard would better match the stated affected range. ########## content/solr/vex/2026-06-18-cve-2025-11143.md: ########## @@ -2,7 +2,7 @@ cve: CVE-2025-11143 category: - solr/vex -versions: "≤ 9.x" +versions: "7.3.0-10.0.0" jars: - jetty-http-10.0.26.jar Review Comment: The `jars` entry is pinned to `jetty-http-10.0.26.jar`, but this VEX now claims the affected Solr range is 7.3.0–10.0.0 and the body notes different bundled Jetty versions across that range (9.4.x, 10.0.x, 12.0.27). Consider using a wildcard so the JAR identifier matches the full version range being described. ########## content/solr/vex/2026-05-04-cve-2026-42440.md: ########## @@ -2,7 +2,7 @@ cve: CVE-2026-42440 category: - solr/vex -versions: "< 10.1.0" +versions: "7.3.0-10.0.0" jars: - opennlp-tools-1.9.4.jar Review Comment: The `versions` field currently includes all Solr releases from 7.3.0 through 10.0.0, but the body states this CVE is fixed in Solr 9.11 and Solr 10.1. The displayed affected range should exclude 9.11+ (and 10.1+) to stay consistent with the narrative. ########## content/solr/vex/2025-08-04-cve-2025-48924.md: ########## @@ -3,9 +3,21 @@ cve: CVE-2025-48924 category: - solr/vex versions: "9.0.0-9.9.0" +jars: + - commons-lang3-3.15.0.jar Review Comment: The analysis notes Solr 9.0–9.9 ships `commons-lang3` versions 3.12.0 through 3.15.0, but the `jars` list is pinned to `commons-lang3-3.15.0.jar`. Consider using a wildcard so the JAR identifier covers the full stated range. ########## content/solr/vex/2022-12-14-cve-2022-25168.md: ########## @@ -2,11 +2,17 @@ cve: CVE-2022-25168 category: - solr/vex -versions: "≤ 9.0" +versions: "4.4.0-9.0.0" jars: - - hadoop-common-3.2.2.jar + - hadoop-common-3.3.2.jar Review Comment: The affected Solr range spans many Hadoop versions, but the `jars` list is pinned to `hadoop-common-3.3.2.jar`. Consider using a wildcard so the JAR identifier covers the full stated range. ########## content/solr/vex/2024-01-12-cve-2023-51074.md: ########## @@ -4,7 +4,7 @@ cve: - GHSA-pfh2-hfmq-phg5 category: - solr/vex -versions: "≤ 9.5" +versions: "8.1.0-9.5.0" jars: - json-path-2.8.0.jar Review Comment: The body explains Solr shipped multiple affected json-path versions (2.4.0, 2.7.0, 2.8.0) in the 8.1.0–9.5.0 range, but the `jars` list is pinned to `json-path-2.8.0.jar`. Consider using a wildcard so the JAR identifier matches the full affected range being described. ########## content/solr/vex/2022-12-14-cve-2022-42889.md: ########## @@ -2,11 +2,17 @@ cve: CVE-2022-42889 category: - solr/vex -versions: "≤ 9.0" +versions: "8.1.0-9.0.0" jars: - - commons-text-1.9.jar + - commons-text-1.8.jar Review Comment: The body says Solr shipped affected `commons-text` versions 1.6 through 1.8 across Solr 8.1.0–9.0.0, but the `jars` list is pinned to `commons-text-1.8.jar`. Consider using a wildcard so the JAR identifier covers the full stated range. ########## content/solr/vex/2025-02-26-cve-2024-6763.md: ########## @@ -2,11 +2,18 @@ cve: CVE-2024-6763 category: - solr/vex -versions: "≤ 9.7" +versions: "4.0.0-9.10.1" jars: - jetty-http-10.0.22.jar Review Comment: This VEX describes Jetty 8.1.x/9.4.x/10.0.x being bundled across Solr 4.0.0–9.10.1, but the `jars` list is pinned to `jetty-http-10.0.22.jar`. Consider using a wildcard so the JAR identifier covers the full stated range. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
