Staying on XP? Sitecore 10.5 and the Solr 10 Upgrade You Can’t Skip

Sitecore XP 10.5 finally shipped last week (August 5th). If you’re one of the many teams staying on XP for a while yet, this is the release to plan for.

It’s not a flashy one. Most of the highlights are infrastructure: Windows Server 2025, SQL Server 2025, .NET Framework 4.8.1, Solr 10 and a refreshed look in the authoring UI (yes, the classic black and red Content Editor chrome finally got a makeover). But a couple of the changes are hard requirements, and Solr is the big one.

The changes that drive your plan

• Solr 10 only. Solr 8 and 9 are no longer supported, and unlike the 10.4.1 jump to Solr 9.8, there’s no backward-compatibility path. The version-specific schema populate helpers are gone.
• Basic authentication is mandatory. Starting with 10.5, every Sitecore-to-Solr connection must use HTTP Basic auth.
• .NET Framework 4.8.1. All platform and component assemblies target 4.8.1. Anything custom has to retarget too.
• SQL Server 2022 or 2025. If you’re still on SQL 2019, that’s part of the upgrade now.
• Application Insights needs a connection string, not an instrumentation key.
• POST for Solr queries by default. ContentSearch.Solr.SendPostRequests now defaults to true, which fixes the long-query HTTP 414 problem. You probably want to leave this alone, but it’s good to know if you have proxies or WAF rules in front of Solr that only expected GETs.
• Check your modules. At release, Sitecore listed several modules as still going through compatibility verification. Check the 10.5 download page for the current status of everything you use before you schedule anything.

Upgrade order

Because of the dependencies, the order matters. This is the sequence I’d use:

1. Infrastructure first: Windows Server, SQL Server, .NET Framework 4.8.1 on every role
2. Stand up Solr 10 with authentication (next section)
3. Retarget your solution to .NET 4.8.1 and update your Sitecore NuGet references
4. Run the Sitecore upgrade for the platform databases and roles
5. Point Sitecore at Solr 10, populate the schema and rebuild indexes
6. Fix App Insights config, then smoke test, then performance test

Doing Solr before the platform upgrade means you can stand it up, secure it and test it independently instead of debugging Solr and Sitecore at the same time.

Solr 10 with Basic auth

Sitecore uses two Solr accounts:

• An admin account, used during setup to create and configure Solr resources. The docs list the minimum permissions: core-admin-read, core-admin-edit, collection-admin-read and collection-admin-edit (SolrCloud only), security-read, security-edit and health.
• A connection account with the minimum permissions for runtime requests. Sitecore creates it during setup, and the Sitecore roles use it for day-to-day queries.

Solr’s Basic auth plugin lives in security.json. A minimal starting point looks like this – generate your own credential hashes, never reuse examples:

{
  "authentication": {
    "class": "solr.BasicAuthPlugin",
    "blockUnknown": true,
    "credentials": {
      "solr-admin": "<hashed password> <salt>"
    }
  },
  "authorization": {
    "class": "solr.RuleBasedAuthorizationPlugin",
    "permissions": [
      { "name": "security-edit", "role": "admin" },
      { "name": "security-read", "role": "admin" },
      { "name": "core-admin-edit", "role": "admin" },
      { "name": "core-admin-read", "role": "admin" },
      { "name": "health", "role": "admin" }
    ],
    "user-role": { "solr-admin": "admin" }
  }
}

blockUnknown: true is the important line. Without it, unauthenticated requests still get through to anything a permission doesn’t explicitly cover.

On the Sitecore side, credentials go in the connection string:

<!-- App_Config/ConnectionStrings.config -->
<add name="solr.search"
     connectionString="https://sitecore-conn:REPLACE_ME@solr.internal.example.com:8983/solr" />

If your password has characters like @, : or /, URL-encode them. It is an easy one to lose an hour on.

For containers, the Solr secrets were split up. Instead of a single sitecore-solr-connection-string.txt (and the xDB one), you now provide separate values for the admin username and password, the connection username and password, and the Solr instance, port and protocol. Update your Kubernetes secrets or .env files accordingly.

A quick connectivity check

Before you point Sitecore at the new Solr, make sure the connection account works and anonymous requests don’t:

$solr = 'https://solr.internal.example.com:8983/solr'
$cred = Get-Credential -UserName 'sitecore-conn' -Message 'Solr connection account'

# Should succeed
Invoke-RestMethod "$solr/admin/info/system?wt=json" -Credential $cred -Authentication Basic |
  Select-Object -ExpandProperty lucene

# Should FAIL with 401 - if this works, blockUnknown isn't doing its job
try {
  Invoke-RestMethod "$solr/admin/info/system?wt=json" | Out-Null
  Write-Warning 'Anonymous request succeeded - Solr is not locked down!'
} catch {
  Write-Host "Anonymous request rejected: $($_.Exception.Response.StatusCode)" -ForegroundColor Green
}

(-Authentication Basic needs PowerShell 7. On Windows PowerShell 5.1, build the Authorization header yourself.)

Is 10.5 worth it?

If you’re on 10.3 or 10.4 and planning to stay on XP for a while, yes. You get supported infrastructure for the next few years, and the Solr auth change is something you should have been doing anyway.

If you’re planning to move to SitecoreAI within the next year, it’s a harder call. A platform upgrade and a migration are both real projects, and doing one right before the other is a lot of change in a short window. Talk through the timeline honestly with your stakeholders before you commit to both.

Resources

• Sitecore XP 10.5 release notes: https://developers.sitecore.com/downloads/Sitecore_Experience_Platform/105/Sitecore_Experience_Platform_105/Release_Notes
• XP 10.5 breaking changes: https://developers.sitecore.com/downloads/Sitecore_Experience_Platform/105/Sitecore_Experience_Platform_105/Breaking_Changes
• Configure Solr authentication and permissions (10.5): https://doc.sitecore.com/xp/en/developers/105/guides/installation-guide-for-the-xp-scaled-topology/solr.html
• Solr Basic Authentication plugin: https://solr.apache.org/guide/solr/latest/deployment-guide/basic-authentication-plugin.html