Update M2E (Vulnerability in Apache Lucene 8.9)

[siakhooi]

Hi,

There is a vulnerability report on apache lucene 8.9 and request us to upgrade to 8.10.
opensearch-project/OpenSearch#687
https://issues.apache.org/jira/browse/LUCENE-9981

tracing from our codes, into redhat.java (vscode plugin) that contains a file called
org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar
that contains lucene-*-5.5.5.jar

further trace found that it is coming from
http://download.eclipse.org/jdtls/snapshots/jdt-language-server-latest.tar.gz

Will this issue be fixed? any help are very much appreciated! thank you.

Path:
redhat.java\extension\server\plugins\org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar
redhat.java\extension\server\plugins\org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar\jars\lucene-analyzers-common-5.5.5.jar
redhat.java\extension\server\plugins\org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar\jars\lucene-backward-codecs-5.5.5.jar
redhat.java\extension\server\plugins\org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar\jars\lucene-core-5.5.5.jar
redhat.java\extension\server\plugins\org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar\jars\lucene-highlighter-5.5.5.jar
redhat.java\extension\server\plugins\org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar\jars\lucene-join-5.5.5.jar
redhat.java\extension\server\plugins\org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar\jars\lucene-memory-5.5.5.jar
redhat.java\extension\server\plugins\org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar\jars\lucene-queries-5.5.5.jar
redhat.java\extension\server\plugins\org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar\jars\lucene-queryparser-5.5.5.jar
redhat.java\extension\server\plugins\org.eclipse.m2e.maven.indexer_1.18.1.20211011-2139.jar\jars\lucene-sandbox-5.5.5.jar

[rgrunber]

I know that m2e eliminated a lot of stuff related to the m2e.maven.indexer recently so maybe there's a chance that if we update JDT-LS to use a more recent version, it will simply be eliminated. @mickaelistria , is this the case ?

[mickaelistria]

Indeed, m2e 2.0 won't contain indexer anymore and should be released in about 2 weeks. When JDT-LS bumps to this new version, Apache Lucene won't be here any more.

[rgrunber]

As mentioned by @fbricon , we're going to be doing this eventually, but given that there are likely breaking changes, this will take some time to get right.