Merge branch 'cassandra-5.0' into trunk

* cassandra-5.0:
  Suppress CVE-2024-45772 lucene-core-9.7.0.jar

.build/owasp/dependency-check-suppressions.xml

@@ -43,4 +43,10 @@
         <cve>CVE-2023-6378</cve>
         <cve>CVE-2023-6481</cve>
     </suppress>
+
+    <!-- https://issues.apache.org/jira/browse/CASSANDRA-20024 -->
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/org\.apache\.lucene/lucene\-.*@9.7.0$</packageUrl>
+        <cve>CVE-2024-45772</cve>
+    </suppress>
 </suppressions>

.build/parent-pom-template.xml

@@ -1219,12 +1219,12 @@
       <dependency>
         <groupId>org.apache.lucene</groupId>
         <artifactId>lucene-core</artifactId>
-        <version>9.7.0</version>
+        <version>9.12.0</version>
       </dependency>
       <dependency>
         <groupId>org.apache.lucene</groupId>
         <artifactId>lucene-analysis-common</artifactId>
-        <version>9.7.0</version>
+        <version>9.12.0</version>
       </dependency>
       <dependency>
         <groupId>io.github.jbellis</groupId>

CHANGES.txt

@@ -93,6 +93,7 @@
  * Add the ability to disable bulk loading of SSTables (CASSANDRA-18781)
  * Clean up obsolete functions and simplify cql_version handling in cqlsh (CASSANDRA-18787)
 Merged from 5.0:
+ * Suppress CVE-2024-45772, upgrade to lucene-core-9.12.0.jar (CASSANDRA-20024)
  * Use SinglePartitionReadCommand for index queries that use strict filtering (CASSANDRA-19968)
  * Always write local expiration time as an int to LivenessInfo digest (CASSANDRA-19989)
  * Enables IAuthenticator's to return own AuthenticateMessage (CASSANDRA-19984)

src/java/org/apache/cassandra/index/sai/disk/io/SeekingRandomAccessInput.java

@@ -62,6 +62,12 @@ public class SeekingRandomAccessInput implements RandomAccessInput
         return in.readLong();
     }
 
+    @Override
+    public long length()
+    {
+        throw new UnsupportedOperationException("calling length() on SeekingRandomAccessInput not supported");
+    }
+
     @Override
     public String toString()
     {