feat!: require minimum JDK 17 - #803
Conversation
BREAKING CHANGE: Drop support for JDK 8 and JDK 11. The minimum required Java version is now 17. Signed-off-by: Jeremy Long <jeremy.long@gmail.com>
|
Thanks for working on this. I understand the motivation - I looked at the linked discussion and PR - there is no clear technical reason given for why Dropping Java 8 and 11 support is a breaking change for a significant portion of the user base, particularly enterprises, which are often constrained to older Java versions. It can be because of vendor support or longed-lived development cycles. Orcale's extended support for Java 8 runs until 2030 meaning there are plenty of legitimate environments still running it. Pushing them off the CycloneDX tooling without a solid reason is rough. Please get me right - I’m not saying never upgrade. I’m just asking for a better reason than “because the core library did it”. Would love to hear if there's a concrete technical constraint I'm missing. |
|
Completely understand your concern and I agree. Even with OWASP dependency-check, I only went to 11.0 after I knew several large U.S. banks had finished migration away from 8 - and ODC is still at 11.0 support (we have several libraries that we needed to upgrade and they no longer supported 8). I'm fine pushing back on the cyclonedx-java-core project to support Java 11. |
|
Hi, the primary reason is "ecosystem pressure". In the Slack discussion I linked in the core lib PR, I posted:
Since then, also the JSON schema validator we depend on has raised their baseline to 17. There is never a perfect time to make these breaking changes unfortunately, but we have to start somewhere.
It's great that enterprises can buy extended support for old Java versions, but that doesn't address the technical debt caused by libraries that stop supporting those versions. Spring 6 (released 3 years ago) also requires Java 17, as do many other enterprise-grade frameworks and libraries. To be clear I am not the one making calls here, so if there is legitimate reason to reverse this I'm sure we can figure something out.
Based on @skhokhlov's comment my impression is that even 11 is too high? |
|
While there are legitimate environments that are running Java 8 - what I've experienced is that they are rarely using the latest dev tools (i.e., running older versions of everything - not just the JDK). With dependency-check we did end Java 8 support - you can still analyze code targeting Java 8. However, you have to use a newer JRE to perform the analysis. We recently added telemetry to dependency-check and we are still seeing Java 11 usage: As such, I would expect similar usage for the cyclonedx-gradle-plugin. Thus, supporting Java 11 (and possibly 8) should likely continue. I know this isn't ideal for tool maintainers - but it is the reality of the landscape. |
| useJUnitPlatform() | ||
| maxParallelForks = (Runtime.getRuntime().availableProcessors() / 2).coerceAtLeast(1) | ||
| if (version >= 11) { | ||
| if (version >= 17) { |
There was a problem hiding this comment.
There's no reason to retain the condition here, it's always true now.
|
I have started a new discussion on potentially lowering the Java baseline: https://cyclonedx.slack.com/archives/CUYQ4K67M/p1774605342557269 |
|
I am closing this for now. |
5 participants
BREAKING CHANGE: Drop support for JDK 8 and JDK 11. The minimum required Java version is now 17.
This change is to support the upgrade of the
cyclonedx-core-javalibrary, which now requires JDK 17.0. See the discussion and PR.