In Optimize 7, bump Apache Lucene to a version >= 9.0

[tasso94]

Acceptance Criteria (Required on creation)

Optimize 7 uses a version of Apache Lucene >= 9.0.

Hints

Links

• https://jira.camunda.com/browse/SEC-1187
• https://github.com/camunda/camunda-optimize/pull/15031

Breakdown

Pull Requests

Preview Give feedback

1. https://github.com/camunda/camunda-optimize/pull/15113
2. https://github.com/camunda/camunda-optimize/pull/15208
3. https://github.com/camunda/camunda-optimize/pull/15209

Dev2QA handover

• Does this ticket need a QA test and the testing goals are not clear from the description? Add a Dev2QA handover comment

[yanavasileva]

• https://lucene.apache.org/core/9_0_0/MIGRATE.html
• https://central.sonatype.com/artifact/org.apache.lucene/lucene-analysis-common/versions
• https://central.sonatype.com/artifact/org.apache.lucene/lucene-core/9.0.0/versions
• https://lucene.apache.org/core/10_0_0/MIGRATE.html
• https://lucene.apache.org/core/10_0_0/core/org/apache/lucene/search/TopDocs.html
• https://lucene.apache.org/core/10_0_0/
• https://cwiki.apache.org/confluence/display/lucene

[tasso94]

Hey @yanavasileva, if this change is not breaking, can we backport it to the last three Optimize versions? Like this we get rid of the vulnerability scanner hit in older versions.

[yanavasileva]

I will check if I can backport.

[yanavasileva]

Library was introduced in 3.14. I backported the change to it.