<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1250">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello Lovro,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
To clarify Alan's remarks, there's a dedicated jdk-updates-dev list and a jdk-updates project responsible for any released jdk; for example, if 23 is released, the subsequent releases of 23.0.1 and 23.0.2, etc. are their responsibility. A request for backporting
critical security fixes to 1 release before the latest should be raised to the jdk-updates project., which is usually constituted of "the companies and organizations that make supported JDK releases available."</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
For the frequency of security fixes: there's a <a href="https://openjdk.org/groups/vulnerability/">
https://openjdk.org/groups/vulnerability/</a> vulnerabiltiy group that releases security fixes every quarter (see
<a href="https://mail.openjdk.org/pipermail/vuln-announce/">https://mail.openjdk.org/pipermail/vuln-announce/</a>), usually in Jan, Apr, Jul, and Oct. Do you wish for Apr and Oct vulnerability fixes to be incorporated into the last release before the latest
(released just one month prior)? You can raise this request to the jdk-updates-dev list there.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I have heard that even backporting even security fixes would be a heavy maintenance cost; so, the updates group might reject your request of 1 year of security fixes, as new releases roll out every half a year. But a security fix for the one version before
the latest released version release makes sense to me, especially that the new version is just released for one month. Ultimately, it is up to jdk-update project's discretion, so go ask them.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Regards,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Chen Liang</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> jdk-dev <jdk-dev-retn@openjdk.org> on behalf of Alan Bateman <alan.bateman@oracle.com><br>
<b>Sent:</b> Monday, August 26, 2024 2:23 AM<br>
<b>To:</b> Lovro Pandžić <Lovro.Pandzic@infobip.com>; jdk-dev@openjdk.org <jdk-dev@openjdk.org><br>
<b>Subject:</b> Re: Vulnerability of the non LTS JDK releases</font>
<div> </div>
</div>
<div>On 26/08/2024 06:38, Lovro Pandžić wrote:<br>
<blockquote type="cite">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Aptos}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Aptos",sans-serif}
.x_MsoChpDefault
{font-size:11.0pt}
div.x_WordSection1
{}
-->
</style>
<div class="x_WordSection1">
<p class="x_MsoNormal"><span lang="EN-US">Hello all,</span></p>
<p class="x_MsoNormal"><span lang="EN-US"> </span></p>
<p class="x_MsoNormal"><span lang="EN-US">Not sure if this is the right address to talk about this issue so feel free to redirect me to another if it’s more appropriate.</span></p>
</div>
</blockquote>
<br>
Your question isn't unreasonable but it's not really a question for the OpenJDK project, instead it's a question for the companies and organizations that make supported JDK releases available.<br>
<br>
<br>
<blockquote type="cite">
<div class="x_WordSection1">
<p class="x_MsoNormal"><span lang="EN-US"> </span></p>
<p class="x_MsoNormal"><span lang="EN-US">:</span></p>
<p class="x_MsoNormal"><span lang="EN-US"> </span></p>
<p class="x_MsoNormal"><span lang="EN-US">Projects that want to follow the train in it’s tracks and be on latest, usually non lts, version and that use any non trivial kind of dependency (Spring, Sonar, …) they must accept the fact that there will be periods
of time (usually a month or two) where they’ll be forced to stay on an unsupported non LTS version until all of their dependencies add support for latest JDK version so they can upgrade as well.</span></p>
<br>
</div>
</blockquote>
Just a reminder that there Early Access (EA) builds published weekly so these projects don't need to wait until the GA to test. Ongoing testing with EA builds help find issues earlier and allows these projects to align their releases with the JDK releases.<br>
<br>
-Alan<br>
</div>
</body>
</html>