Major Changes in Solr 9

The Http2SolrClient classes powered by the Jetty Http library are no longer marked as experimental.

Solrj now offers a lightweight client based on java.net.http.HttpClient: HttpJdkSolrClient

SolrJ now offers an improved async request API

Distributed stats can be disabled via request parameter

Query timeouts (limits) may now be based on either CPU time as well as wall clock

Inactive shards will now be cleaned up periodically

Circuit breakers can now be configured globally, not only per collection. See Configuring Circuit Breakers for more information.

Solr will now automatically resolve all environment variables with SOLR_ prefix, and set the corresponding system property. This is useful for configuring more aspects of Solr through environment variables, such as for containers. Underscores are replaced with dots and strings are lowercased. For example, while you earlier had to set the system property -Dsolr.clustering.enabled=true to enable clustering, you can now set the equivalent environment variable SOLR_CLUSTERING_ENABLED=true instead.

Collection and Replica Properties may now be used as property substitution variables in configuration files (e.g. solrconfig.xml).

Solr now auto-reloads updated keystore and truststore files when TLS is enabled.

Tracing support has received a number of quality-of-life improvements, including improved tracking of distributed collection commands and increased coverage for internal requests made with the Apache and Jetty HTTP clients.

The build in ConfigSets (_default and sample_techproducts_configs), now use a default autoSoftCommit time of 3 seconds, meaning that documents will be searchable within 3 seconds of uploading them. Please refer to the Soft Commit documentation for more information on how this change will effect you. Upgrading existing clouds and use-cases that have custom configSets will not be affected by this change.

The default minimalFreeDiskGB value has been lowered from 20GB to 5GB when using the AffinityPlacementPlugin. Therefore, when using the default settings, nodes that were previously excluded from Replica placements due to low available disk space may be selected after upgrading.

The Embedded Zookeeper can now be configured to listen to (or bind to) more hosts than just localhost, see the Network Configuration documentation for more information.

The Circuit Breakers are now pluggable, and you can define multiple circuit breakers including custom ones. The existing CircuitBreakerManager is deprecated, and users are encouraged to switch to the new plugins. While the old CircuitBreakerManager returned HTTP 503 when a circuit breaker was tripped, the new plugins return HTTP 429.

Since Solr 8.4.1/8.5.0, the solr.jetty.ssl.verifyClientHostName sysProp and SOLR_SSL_CLIENT_HOSTNAME_VERIFICATION envVar have been used incorrectly. It has instead been used to override the solr.ssl.checkPeerName sysProp in the HTTP2SolrClient. This has been fixed, and the setting once again tells the server to check the originating client hostname against the client certificate when doing mTLS. This option is still enabled by default.

The solr.jetty.ssl.sniHostCheck option now defaults to the value of SOLR_SSL_CHECK_PEER_NAME, if it is provided. This will enable client and server hostName check settings to be governed by the same environment variable. If users want separate client/server settings, they can manually override the solr.jetty.ssl.sniHostCheck option in SOLR_OPTS.

The rid request id query parameter has been deprecated in favor of the always-on trace generation. To disable the rid generation set the system property solr.disableRequestId to true. To disable the always-on trace generation set the system property solr.alwaysOnTraceId to false.

The FieldValueFeature class now always uses DocValues when docValues=true is set. A LegacyFieldValueFeature class provides the prior behaviour of not using DocValues when the docValues=true and stored=true field attributes are both set.

From Solr 9.4 using Lucene 9.8 onwards DelegatingCollector.finish clashes with the super class’s LeafCollector.finish method. Any custom component extending the DelegatingCollector needs to rename the finish method to complete to follow Solr’s implementation.

Solr now comes with two binary releases and docker images, full and slim. The Installing Solr page provides information on what is included in each. Please refer to the Solr Downloads site for information on how to download these offerings.

Solr now provides an "Install Shard" API to allow users who have built (per-shard) indices offline to import them into SolrCloud shards.

The bin/solr -i and bin/solr -info options were removed in favour of the bin/solr status command.

Use of stream.file, stream.url and stream.body params are no longer enabled via configuration in solrconfig.xml, nor dynamic equivalents with the config API. Older configuration now does nothing. Instead, set an env var: SOLR_ENABLE_REMOTE_STREAMING or SOLR_ENABLE_STREAM_BODY or system property equivalents.

The method for specifying sysProps that contain sensitive information has been streamlined. Now the sysProp -Dsolr.hiddenSysProps or the envVar SOLR_HIDDEN_SYS_PROPS are available to provide a comma-separated list of patterns to match sysProps that should be hidden or redacted. Please see the hiddenSysProps section for more information.

The Schema Designer now utilizes the same trust model as the ConfigSet Upload API.

The customization of the Official Solr Dockerfile has been changed. The customization options SOLR_DOWNLOAD_URL, SOLR_CLOSER_URL, SOLR_DIST_URL and SOLR_ARCHIVE_URL, have been removed. The only way to specify a custom location for the Solr binaries is through SOLR_DOWNLOAD_SERVER. If the server URL contains apache.org, then the Dockerfile will check gpg signature files. If the server URL does not contain apache.org, then the gpg signature checking will be skipped.

When Solr loads a core from a filesystem it will check for corresponding cluster state in ZooKeeper. Prior to Solr 9.3, if no corresponding entry existed the core was deleted automatically to remove the orphaned files. As of Solr 9.3 that behaviour is no longer enabled by default. See Unknown core deletion.

Query timeouts with timeAllowed are implemented differently. It should be faster albeit have less fidelity – will not timeout a query outside of core query processing (e.g. won’t cancel spellcheck or faceting). Use solr.useExitableDirectoryReader to use the previous behavior. Please share your experience with Solr developers! The previous behavior should not be enabled if timeAllowed isn’t used because unfortunately its performance tax is now imposed on all queries, even those without timeAllowed.

Solr’s experimental "v2" API has seen a number of improvements in the 9.3 release.

Solr upgraded to Jetty 10.x from 9.x due to Jetty 9.x is now end of life. Jetty 10.x has a Java 11 minimum and matches Solr 9 minimum Java version. Jetty logging has been replaced with slf4j again matching Solr. See https://webtide.com/jetty-10-and-11-have-arrived/ for additional Jetty 10.x highlights.

Solr no longer duplicates certain Jetty "server" library dependencies between server/lib and WEB-INF/lib (jetty-util, jetty-io, etc.). This is an improvement to the binary release artifact, but Jetty does not allow web-apps (Solr) to share these libraries by default. The server/contexts/solr-jetty-context.xml now explicitly removes these restrictions, allowing Solr to share these "server" jars which now live in server/lib/ext.

The "Transient Cores" feature is now deprecated.

When using Solr (or SolrJ) with an SSL-enabled Solr cluster using HTTP2, the default -Dsolr.ssl.checkPeerName value is now true. This is what has been documented in Enabling SSL, and matches the functionality of the original HttpSolrClient.

A new opentelemetry module is added, with support for OTEL tracing in OTLP format using gRPC.

The OS version of the official Docker image and provided Dockerfile has been upgraded to Ubuntu 22 (jammy) from Ubuntu 20 (focal). Solr’s Docker image now requires Docker engine version 20.10.10 or newer.

Streaming Expressions have been moved out of Solrj core into its own module called solrj-streaming. This change will only affect users that have used streaming expression classes in clients outside of Solr. Streaming expressions sent to the /stream handler will still operate exactly as before. External clients using streaming expression classes will need to update their depenencies to reference the solrj-streaming artifacts under the org.apache.solr groupId.

Loading solr.xml from Zookeeper is deprecated. See Configuring solr.xml.

The Analytics Component has been deprecated. Consider using JSON Facet API as a substitute. Please notify the project if there’s functionality you need that isn’t currently covered by JSON facets.

The jaegertracer-configurator module is deprecated for removal in Solr 10. Users should start migrating to the new opentelemetry module.

Added Lucene91HnswVectorsFormat codec for DenseVectorField. In order to use the new codec, reindex is necessary.

Dense Vector "Neural" Search through DenseVectorField fieldType and K-Nearest-Neighbor (KNN) Query Parser.

Admin UI support for SQL Querying.

New snowball stemmers: Hindi, Indonesian, Nepali, Serbian, Tamil, and Yiddish.

New NorwegianNormalizationFilter

Implicit /terms handler now returns terms across all shards in SolrCloud instead of only the local core. Users/apps may be assuming the old behavior. A request can be modified via the standard distrib=false param to only use the local core receiving the request.

SQL support has been moved to the sql module. Existing Solr configurations do not need any SQL related changes, however the module needs to be installed - see the section SQL Query Language.

JSON aggregations uses corrected sample formula to compute standard deviation and variance. The computation of stdDev and variance in JSON aggregation is same as StatsComponent.

Facet count in Json Facet module always returns a long value, irrespective of number of shards.

MacroExpander will no longer will expand URL parameters inside of the expr parameter (used by streaming expressions). Additionally, users are advised to use the InjectionDefense class when constructing streaming expressions that include user supplied data to avoid risks similar to SQL injection. The legacy behavior of expanding the expr parameter can be reinstated with -DStreamingExpressionMacros=true passed to the JVM at startup

The response format for field values serialized as raw XML (via the [xml] raw value DocTransformer and wt=xml) has changed. Previously, values were dropped in directly as top-level child elements of each <doc>, obscuring associated field names and yielding inconsistent <doc> structure. As of version 9.0, raw values are wrapped in a <raw name="field_name">[…​]</raw> element at the top level of each <doc> (or within an enclosing <arr name="field_name"><raw>[…​]</raw></arr> element for multi-valued fields). Existing clients that parse field values serialized in this way will need to be updated accordingly.

Highlighting: hl.method=unified is the new default. Use hl.method=original to switch back if needed.

solr.xml maxBooleanClauses is now enforced recursively. Users who upgrade from prior versions of Solr may find that some requests involving complex internal query structures (Example: long query strings using edismax with many qf and pf fields that include query time synonym expansion) which worked in the past now hit this limit and fail. Users in this situation are advised to consider the complexity of their queries/configuration, and increase the value of maxBooleanClauses if warranted.

Atomic/partial updates to nested documents now require the _root_ field to clearly show the document isn’t a root document. Solr 8 would fallback on the _route_ param but no longer.

New Certificate Authentication Plugin, enabling end-to-end use of x509 client certificates for Authentication and Authorization.

Improved security when using PKI Authentication plugin.

Upgrade to Zookeeper 3.7, allowing for TLS protected ZK communication.

All request handlers support security permissions. Users may have to adapt their security.json.

Ability to disable admin UI through a system property.

The property blockUnknown in the BasicAuthPlugin and the JWTAuthPlugin now defaults to true instead of false. This change is backward incompatible. If you need the pre-9.0 default behavior, you need to explicitly set blockUnknown:false in security.json.

Solr now runs with the Java security manager enabled by default. Hadoop users may need to disable this.

Solr now binds to localhost network interface by default for better out of the box security. Administrators that need Solr exposed more broadly can change the SOLR_JETTY_HOST property in their Solr include (solr.in.sh/solr.in.cmd) file.

Solr embedded zookeeper only binds to localhost by default. This embedded zookeeper should not be used in production. If you rely upon the previous behavior, then you can change the clientPortAddress in solr/server/solr/zoo.cfg

Jetty low level request-logging in NCSA format is now enabled by default, with a retention of 3 days worth of logs. This may require some more disk space for logs than was the case in version 8.x. See Configuring Logging for how to change this.

Hadoop authentication support has been moved to the new hadoop-auth module. Users need to add the module hadoop-auth to classpath. The plugins has also changed package name to org.apache.solr.security.hadoop, but can still be loaded as shortform class="solr.HadoopAuthPlugin", class="solr.ConfigurableInternodeAuthHadoopPlugin" or class="solr.KerberosPlugin" - see the section Hadoop Authentication Plugin.

JWTAuthPlugin has been moved to a module. Users need to add the module jwt-auth to classpath. The plugin has also changed package name to org.apache.solr.security.jwt, but can still be loaded as shortform class="solr.JWTAuthPlugin".

Dependency updates - A lot of dependency updates removes several security issues from dependencies, and thus make Solr more secure.

The allow-list defining allowed URLs for the shards parameter is not in the shardHandler configuration anymore. It is defined by the allowUrls top-level property of the solr.xml file. For more information, see Format of solr.allowUrls documentation.

To improve security, StatelessScriptUpdateProcessorFactory has been renamed as ScriptUpdateProcessorFactory and moved to the scripting Module instead of shipping as part of Solr core. This module needs to be enabled explicitly.

To improve security, XSLTResponseWriter has been moved to the scripting Module instead of shipping as part of Solr core. This module needs to be enabled explicitly.

Rate limiting provides a way to throttle update and search requests based on usage metrics.

A new Task management interface allows declaring tasks as cancellable and trackable.

Ability to specify node roles in Solr. This release supports overseer and data roles out of the box.

New API for pluggable Replica Placement Plugins that replaces the auto-scaling framework.

Support for distributed processing of cluster state updates and collection API calls, without relying on the Overseer.

Solr is now built and released independently of Lucene (separate Apache projects).

Build system switched to Gradle, no longer uses Ant + Ivy.

Docker image creation is now a part of the Apache Solr GitHub repo.

Docker image documentation is now a part of the reference guide.

Official Docker image upgraded to use JDK17 (by Eclipse Temurin) and ability to create functionally identical local image.

Metrics handler only depends on SolrJ instead of core and has its own log4j2.xml and no longer shares Solr’s logging config.

Only SearchHandler and subclasses have "local" metrics now. It’s now tracked as if it’s another handler with a "[shard]" suffix, e.g. "/select[shard]". There are no longer ".distrib." named metrics; all metrics are assumed to be such except "[shard]". The default Prometheus exporter config splits that component to a new label named "internal". The sample Grafana dashboard now filters to include or exclude this.

The default port of "Prometheus exporter" has changed from 9983 to 8989, so you may need to adjust your configuration after upgrade.

Logging is now asynchronous by default. There’s a small window where log messages may be lost in the event of some hard crash. Switch back to synchronous logging if this is unacceptable, see comments in the log4j2 configuration files (log4j2.xml by default).

Log4J configuration & Solr MDC values - MDC values that Solr sets for use by Logging calls (such as the collection name, shard name, replica name, etc…​) have been modified to now be "bare" values, without the special single character prefixes that were included in past version. The default log4j2.xml configuration file for Solr has been modified to prepend these same prefixes to MDC values when included in Log messages as part of the <PatternLayout/>. Users who have custom logging configurations that wish to ensure Solr 9.x logs are consistently formatted after upgrading will need to make similar changes to their logging configuration files. See SOLR-15630 for more details.

Jetty Request log is now enabled by default, i.e. logging every request.

The prometheus-exporter is no longer packaged as a Solr Module. It can be found under solr/prometheus-exporter/.

Solr modules (formerly known as contribs) can now easily be enabled by an environment variable (e.g. in solr.in.sh or solr.in.cmd) or as a system property (e.g. in SOLR_OPTS). Example: SOLR_MODULES=extraction,ltr.

The Data Import Handler (DIH) is an independent project now; it is no longer a part of Solr.

No more support for clusterstate.json and MIGRATESTATE API has been removed. If your collections use clusterstate.json you will need to take some steps, described elsewhere in this document.

Auto-scaling framework has been removed. Please refer to Replica Placement Plugins for alternate options.

LegacyBM25SimilarityFactory has been removed.

Legacy SolrCache implementations (LRUCache, LFUCache, FastLRUCache) have been removed. Users have to modify their existing configurations to use CaffeineCache instead.

VelocityResponseWriter is an independent project now; it is no longer a part of Solr. This encompasses all previously included /browse and wt=velocity examples.

Cross Data Center Replication has been removed.

SolrJ clients like HttpSolrClient and LBHttpSolrClient that lacked HTTP2 support have been deprecated. The old CloudSolrClient has been renamed as CloudLegacySolrClient and deprecated.

SimpleFSDirectoryFactory is removed in favor of NIOFSDirectoryFactory

Removed the deprecated HttpSolrClient.RemoteSolrException and HttpSolrClient.RemoteExecutionException. All the usages are replaced by BaseHttpSolrClient.RemoteSolrException and BaseHttpSolrClient.RemoteExecutionException.

maxShardsPerNode parameter has been removed because it was broken and inconsistent with other replica placement strategies. Other relevant placement strategies should be used instead, such as autoscaling policy or rules-based placement.

The binary distribution no longer contains test-framework jars.

Deprecated BlockJoinFacetComponent and BlockJoinDocSetFacetComponent are removed. Users are encouraged to migrate to uniqueBlock() in JSON Facet API.

Core level admin API endpoints /admin/threads, /admin/properties, /admin/logging are now only available at the node level.

Contrib modules are now just "modules". You can easily enable module(s) through environment variable SOLR_MODULES.

Features lifted out as separate modules are: HDFS, Hadoop-Auth, SQL, Scripting, and JWT-Auth.

The "dist" folder in the release has been removed. Please update your <lib> entries in your solrconfig.xml to use the new location.

SolrJ class CloudSolrClient now supports HTTP2. It has a new Builder. See CloudLegacySolrClient for the 8.x version of this class.

In Backup request responses, the response key now uses a map to return information instead of a list. This is only applicable for users returning information in JSON format, which is the default behavior.

SolrMetricProducer / SolrInfoBean APIs have changed and third-party components that implement these APIs need to be updated.

Use of blacklist/whitelist terminology has been completely removed. JWTAuthPlugin parameter algWhitelist is now algAllowlist. The old parameter will still work in 9.x. Environment variables SOLR_IP_WHITELIST and SOLR_IP_BLACKLIST are no longer supported, but replaced with SOLR_IP_ALLOWLIST and SOLR_IP_DENYLIST.

Solr Backups - Async responses for backups now correctly aggregate and return information. For collection’s snapshot backup request responses additional fields indexVersion, indexFileCount, etc. were added similar to incremental backup request responses.

If you are using the HDFS backup repository, you need to change the repository class to org.apache.solr.hdfs.backup.repository.HdfsBackupRepository - see the HDFS Backup Repository section.

HDFS storage support has been moved to a module. Existing Solr configurations do not need any HDFS-related changes, however the module needs to be installed - see the section Solr on HDFS.

The folder $SOLR_HOME/userfiles, used by the "cat" streaming expression, is no longer created automatically on startup. The user must create this folder.

Solr no longer requires a solr.xml in $SOLR_HOME. If one is not found, Solr will instead use the default one from $SOLR_TIP/server/solr/solr.xml. You can revert to the pre-9.0 behaviour by setting environment variable SOLR_SOLRXML_REQUIRED=true or system property -Dsolr.solrxml.required=true. Solr also does not require a zoo.cfg in $SOLR_HOME if started with embedded zookeeper.

base_url has been removed from stored cluster state. If you’re able to upgrade SolrJ to 8.8.x for all of your client applications, then you can set -Dsolr.storeBaseUrl=false (introduced in Solr 8.8.1) to better align the stored state in Zookeeper with future versions of Solr; as of Solr 9.x, the base_url will no longer be persisted in stored state. However, if you are not able to upgrade SolrJ to 8.8.x for all client applications, then you should set -Dsolr.storeBaseUrl=true so that Solr will continue to store the base_url in Zookeeper. For background, see: SOLR-12182 and SOLR-15145. Support for the solr.storeBaseUrl system property will be removed in Solr 10.x and base_url will no longer be stored.

Analyzer components can now be looked up by their SPI names based on the field type configuration.

The solr-extraction module has been cleaned up to produce solr-extraction- jar instead of solr-cell- jars.

Extra lucene libraries used in modules are no longer packaged in lucene-libs/ under module directories in the binary release. Instead, these libraries will be included with all other module dependencies in lib/.

Combining Basic Authentication with Other Schemes

Multiple Authorization Plugins

The config-read pre-defined permission now correctly governs access for various configuration-related APIs. See also Predefined Permissions.

The S3BackupRepository supports configuring the AWS Profile, if necessary. See also S3BackupRepository.

Additionally, backups will now properly succeed after SPLITSHARD operations, and will correctly handle incremental backup purges.

SolrJ now supports uploading configsets.

Upload or paste sample documents to identify fields.

Get a "first" guess at what Solr thinks the field types in the fields should be.

Edit fields, field types, dynamic fields, and supporting files.

See how a field’s analysis will impact your text.

Test how schema changes will impact query-time behavior.

Save your changes to a configset to use with a new collection.

Support added for LIKE, IS NOT NULL, IS NULL, and wildcards (for simplistic LIKE functionality).

Two new aggregation functions, COUNT(DISTINCT field) and APPROX_COUNT_DISTINCT(field), have been added.

Queries using an ORDER BY clause can support OFFSET and FETCH operations.

Multi-valued fields can now be returned.

User permissions have been simplified so access to query endpoints /sql, /select, and /export is sufficient for full access for all SQL queries.

LISTBACKUP: Lists information about each backup stored at the specified repository location. See List Backups for more details.

DELETEBACKUP: Deletes specified backups from the repository. See Delete Backups for more details.

BlockCollapse: If documents have been (or could be) indexed in a way where documents with the same collapse key have been indexed contiguously in the index, a new "block collapse" provides a significant speed improvement over traditional collapse.

Expand Null Groups: A new parameter expand.nullGroup allows an expanded group to be returned containing document with no value in the expanded field. See Expand Component for details.

When doing atomic/partial updates to a child document:

The search results clustering module (Carrot2) has been removed from 8.x Solr due to lack of Java 1.8 compatibility in the dependency that provides online clustering of search results. The module will be re-introduced in Solr 9.0.

Interleaving support has been added to Learning to Rank (LTR). Currently only the Team Draft Interleaving algorithm is supported. For examples using this feature, see the section Running a Rerank Query Interleaving Two Models.

Two metrics have been added for SolrCloud’s Overseer:

The ./bin scripts included with the Prometheus Exporter now allow use of custom java options with environment variables. See the section Environment Variable Options for more details.

The default Grafana dashboards now include panels for query performance monitoring. The default Prometheus Exporter configuration includes metrics like queries-per-second (QPS) and 95th percentiles (P95) to populate the new panels.

The default Prometheus Exporter configuration also includes the two new metrics mentioned in the Metrics above.

The internal logic for identifying 'Solr Home' (solr.solr.home) has been refactored to make testing less error-prone. Plugin developers using SolrPaths.locateSolrHome() or new SolrResourceLoader should check deprecation warnings as existing some existing functionality will be removed in 9.0. SOLR-14934 has more technical details about this change for those concerned.

If upgrading from 8.6.0, please see the 8.6.1 Upgrade notes below for information on performance degradations introduced in 8.6.0 that require some intervention to resolve. If you are already on 8.6.1 or higher, you can ignore these instructions.

The autoscaling framework is now formally deprecated and will be removed in Solr 9.0. The Solr community is working on pluggable API to replace this functionality, with the goal for it to be ready by the time 9.0 is released. Deprecations include: autoscaling policy, triggers, withCollection support, simulation framework, autoscaling suggestions tab in the UI, autoAddReplicas and UTILIZENODE command.

Similarly, rule-based replica placement strategy has been deprecated and will be replaced in Solr 9.0 by APIs for replica placement and cluster events, with plugin-based implementations.

Support for detecting spinning disks has been removed in LUCENE-9576. Corresponding spins metrics in Solr still exist but now they always return false and will be removed in Solr 9.0.

Solr has replaced the terms "master" and "slave" in the codebase and all documentation with "leader" and "follower".

Performance enhancements for the relatedness() statistics function are included with 8.7. These yield the highest benefits with high-cardinality fields and can be disabled if working with lower cardinality fields with a new sweep_collection parameter. See the section relatedness() Options for details.

Solr has relied on the SOLR_STOP_WAIT parameter defined in solr.in.sh or solr.in.cmd to determine how long to wait on startup. A new parameter SOLR_START_WAIT allows defining how long Solr should wait for start up to complete.

The default ZooKeeper client timeout (ZK_CLIENT_TIMEOUT) is now 30 seconds (30000 milliseconds) instead of 15.

It’s now possible to overwrite an existing configset when uploading changes by supplying the overwrite=true parameter to the Configset API.

When deleting a collection that has an automatically created configset (i.e., the configset was copied from the _default collection when the collection was created), the configset will also be deleted if it is not in use by any other collection.

A request ID (rid) is now logged for all distributed search requests (in SolrCloud) which can be used to correlate query events across the system. A parameter disableRequestId=true can be added to disable this if desired.

As mentioned in the 8.6 upgrade notes, a default autoscaling policy was provided starting in 8.6.0. This default autoscaling policy resulted in increasingly slow collection creation calls in large clusters (50+ collections).

curl -X POST -H 'Content-type:application/json'  -d '{set-cluster-policy : [], set-cluster-preferences : []}' http://localhost:8983/api/cluster/autoscaling

NOTE: The default autoscaling policy has been removed as of 8.6.1

The ComputePlan action now supports a collection selector to identify collections based on collection properties to determine which collections should be operated on.

Prior to Solr 8.6 Solr APIs which take a file system location, such as core creation, backup, restore, and others, did not validate the path and Solr would allow any absolute or relative path. Starting in 8.6 only paths that are relative to SOLR_HOME, SOLR_DATA_HOME and coreRootDir are allowed by default.

A new authorization plugin ExternalRoleRuleBasedAuthorizationPlugin is now available. This plugin allows an authentication plugin (such as JWT) to supply a user’s roles instead of maintaining a user-to-role mapping inside Solr.

When authentication is enabled, the Admin UI Dashboard (main screen) now includes a panel that shows the authentication and authorization plugins in use, the logged in username, and the roles assigned to this user. A new link will also appear in the left-hand navigation to allow a user to log out.

The /export handler now supports streaming expressions to allow limiting the output of the export to only matching documents.

The stats, facet, and timeseries expressions now support percentiles and standard deviation aggregations.

Cross Data Center Replication (CDCR), in its current form, is deprecated and is scheduled to be removed in 9.0. This feature is unlikely to be replaced by an identical plugin. However, the community is working on figuring out a replacement feature for disaster recovery and failover.

The Data Import Handler (DIH) is deprecated and is scheduled to be removed in 9.0. Work to replace DIH with a community-supported plugin is underway and may be available soon.

Support to store indexes and backups in HDFS is deprecated and is scheduled to be removed in 9.0. A community-supported version of this may be available as a plugin in the future. For more details, please see SOLR-14021.

If you don’t use async or REQUESTSTATUS operations, you should be able to restart and not see any issues.

If you do use Collection API operations:

If you don’t use Collection API operations, you should be able to do a rolling restart and not see any issues.

If you do use Collection API operations, but you can pause their use during the restart the easiest way is to:

The solrconfig.xml file in Solr’s _default configset has been trimmed of the following previously pre-configured items:

Configsets that have been uploaded with an unsecured Configset API (i.e., when authentication is not enabled) are considered "Untrusted Configsets".

Our default Jetty configuration has been updated to now set a Content-Security-Policy (CSP) by default. See ./server/etc/jetty.xml for details about how it is configured.

Solr’s Blob Store and runtime libs functionality are now deprecated and are planned to be removed from Solr in version 9.0. It has been replaced with the new package management system.

The Velocity response writer is also now deprecated and is planned to be removed from Solr in version 9.0.

SolrJ now supports the shards.preference parameter for single-shard scenarios to ensure multi-shard and single-shard request routing works in the same way.

QueryResponse.getExplainMap() type has changed from Map<String, String> to Map<String, Object> in order to support structured explanations.

Replica routing code has been moved to SolrJ, making those classes available to clients if necessary.

A new DBSCAN clustering streaming evaluator has been added.

The precision stream evaluator can now operate on matrices.

The random streaming expression can now create the x-axis.

Two new aggregations have been added: missing and countvals.

Several aggregations now support multi-valued fields: min, max, avg, sum, sumsq, stddev, variance, and percentile.

After the addition of CaffeineCache in 8.3, legacy SolrCache implementations are deprecated and likely to be removed in 9.0.

Solr has a new cache implementation, CaffeineCache, which is now recommended over other caches. This cache is expected to generally provide most users lower memory footprint, higher hit ratio, and better multi-threaded performance.

A new parameter, maxIdleTime, allows automatic eviction of cache items that have not been used in the defined amount of time. This allows the cache to release some memory and should aid those who want or need to fine-tune their caches.

Routed aliases now use collection properties to identify collections that belong to the alias; prior to 8.2, these aliases used core properties.

Time-routed aliases now include a TRA infix in the collection name, in the pattern <alias>_TRA_<timestamp>.
Collections created with older versions will continue to work.

The behavior of the maxBooleanClauses parameter has changed to reduce the risk of exponential query expansion when dealing with pathological query strings.

JSON Web Tokens (JWT) are now supported for authentication. These allow Solr to assert a user is already authenticated via an external identity provider, such as an OpenID Connect-enabled IdP. For more information, see the section JWT Authentication Plugin.

A new security plugin for audit logging has been added. A default class SolrLogAuditLoggerPlugin is available and configurable in security.json. The base class is also extendable for adding custom audit plugins if needed. See the section Audit Logging for more information.

The output of the REQUESTSTATUS command in the Collections API will now include internal asynchronous requests (if any) in the "success" or "failed" keys.

The CREATE command will now return the appropriate status code (4xx, 5xx, etc.) when the command has failed. Previously, it always returned 0, even in failure.

The MODIFYCOLLECTION command now accepts an attribute to set a collection as read-only. This can be used to block a collection from receiving any updates while still allowing queries to be served. See the section MODIFYCOLLECTION for details on how to use it.

A new command RENAME allows renaming a collection by setting up a one-to-one alias using the new name. For more information, see the section RENAME.

A new command REINDEXCOLLECTION allows indexing existing stored fields from a source collection into a new collection. For more information, please see the section REINDEXCOLLECTION.

The default Log4j2 logging mode has been changed from synchronous to asynchronous. This will improve logging throughput and reduce system contention at the cost of a slight chance that some logging messages may be missed in the event of abnormal Solr termination.

The SolrGangliaReporter has been removed from Solr. The metrics library used by Solr, Dropwizard Metrics, was updated to version 4, and Ganglia support was removed from it due to a dependency on the LGPL license.

Velocity and Velocity Tools were both upgraded as part of this release. Velocity upgraded from 1.7 to 2.0. Please see https://velocity.apache.org/engine/2.0/upgrading.html about upgrading. Velocity Tools upgraded from 2.0 to 3.0. For more details, please see https://velocity.apache.org/tools/3.0/upgrading.html for details about the upgrade.

Solr’s default GC has been changed from CMS to G1. If you prefer to use CMS or any other GC method, you can modify the GC_TUNE section of solr.in.sh (*nix) or solr.in.cmd (Windows).