The Apache Lucene project develops open-source search software.


TLP
---

We added one new committer in the last quarter: Tomás Fernández Löbbe
George Aroush went emeritus from the PMC.

We have closed down the OpenRelevance sub project. The project is dead, mailing lists are currently removed. We have preserved the Wiki.


Lucene Core and Solr
--------------------

Lucene Core is a search-engine toolkit.

Solr is a search server built on top of Lucene Core.

In the last quarter we made two releases of both Lucene Core and Solr:

 - 4.9.0 on 25 June 2014
 - 4.10.0 on 3 Sept 2014

The corresponding Apache Solr Reference Guide was released
as PDF version, generated from the Confluence Wiki:

 - 4.9 on 30 June 2014
 - 4.10 on 7 Sept 2014

The community is very active.

Security: There were two security issues reported:

 - An XXE vulnerability was reported against Apache Solr
   (CVE-2014-3529). The issue was caused by the bundled Apache
   POI library. Apache POI fixed the issue and released
   bugfix packages. An advisory was posted on the Solr web page
   about how to update the bundled libraries in existing
   deployments. The recent release of Apache Solr 4.10.0 is no
   longer vulnerable.
 - External search web pages, referenced by the Lucene/Solr
   site, were vulnerable to an XSS attack. Both providers,
   LucidWorks and Sematext, were contacted and they
   fixed the problem.


PyLucene
--------

PyLucene is a Python integration of Lucene Java.  Development is almost
entirely an automated port, so this project will never require a lot of
developers.  The user community is active.

In the last quarter we made one release of PyLucene:

 - 4.9.0-0 on 17 July 2014