Upgrade Apache Lucene to resolve vulnerability for consumers

[ciscoo]

Upgrade Apache Lucene to resolve vulnerability for consumers

[AngledLuffa]

Gotcha. Well, 9.9.1 exists, so I made a push which upgrades to that version. If you're able to use the dev branch, that should suffice, and if not, I'll look into making a patched CoreNLP release sometime soon

[AngledLuffa]

Some reason you chose 9.8 instead of a 9.9 version?

[ciscoo]

It was the minimum non-vulnerable version. I help maintain some projects internally and I'm not familiar enough with the project. So I opted for the minimum allowed version by our internal Sonar IQ server.

[ciscoo]

Does that publish a snapshot somewhere such as Maven Central? If so, I can try it out Thursday. Otherwise I'd need to wait until a release is made.

[AngledLuffa]

Actually, I'm not sure I can update all the way to 9.9.1 w/o breaking Java 1.8 compatibility. Let me check which versions would actually work with Java 1.8, then hopefully there's one which has the necessary patch in it.

[AngledLuffa]

Honestly I think we're screwed here. The earliest version of Lucene which has this fix is 9.8.0, and it also targets 11. I'll bring it up with my PI in terms of possibly switching to Java 11 in the future.

[ciscoo]

Right, most of the Java ecosystem is moving towards targeting more modern versions of Java.

[AngledLuffa]

#1429