Status

Current state: Under DiscussionAccepted, being implemented

Discussion thread: https://lists.apache.org/thread/7qqknryoh4hxv2s7291j8g5shlcbock3

...

• JSM removal in Java 24 is mandatory and outside Solr's control (see

  Jira
  server ASF JIRA serverId 5aa69414-a9e9-3523-82ec-879b028fb15b key SOLR-17641

  — startup scripts disable the security manager flag on Java ≥ 24).
• The default policy covers standard Solr directory layouts and intra-cluster traffic. Most deployments will require no configuration changes.
• Warn-only default ensures zero disruption on upgrade. Operators can review violation logs before enabling enforce mode.
• Modules that connect to external services (OIDC, OTLP, S3, GCS, Kafka, remote Tika) will may require operator-added policy entries in enforce mode. Each module's reference guide page will include a ready-to-paste snippet.. Consider each one. Perhaps only those with a user-injected URL must be manually added?
• The existing server/etc/security.policy and solr-tests.policy JSM files are deprecated and retained as migration reference only; they are not enforced by the JVM on Java 24+.
• SolrPaths.assertPathAllowed() is deprecated for new callers; existing call sites are retained as defense-in-depth.

...