Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-25724

Really upgrade to OpenNLP 1.9.5

    XMLWordPrintable

Details

    • Unknown

    Description

      XWIKI-24629 manages the version of org.apache.opennlp:opennlp, which is the OpenNLP parent POM (packaging pom, no JAR), so it has no effect on the org.apache.opennlp:opennlp-tools JAR actually bundled through solr-analysis-extras (in xwiki-platform-search-solr-embedded).

      As a consequence, branches still on Solr 9.4.1 bundle opennlp-tools 1.9.4, affected by:

      • CVE-2026-40682 (GHSA-4v8g-86x5-3vrc)
      • CVE-2026-42440 (GHSA-659w-93r5-9j6m)
      • CVE-2026-42027 (GHSA-cx4m-2p55-rw7j)

      The version of org.apache.opennlp:opennlp-tools should be managed instead.

      Attachments

        Activity

          People

            tmortagne Thomas Mortagne
            tmortagne Thomas Mortagne
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: