This blog post is to let our ColdFusion users know that Adobe is aware of all the changes that Oracle has made related to Java and the impact it can have on ColdFusion users.
We are doing our best to ensure that there is minimal to no impact to all our ColdFusion users. We are currently exploring various alternatives within Adobe to handle this change. As soon as we are ready to communicate publicly about our future path, we will keep you posted on this very portal.
We understand that there is quite a bit of apprehension associated with this. We request you to kindly bear with us till we have an update for you.
Staff
109 posts
And the update adding Java 11 support for CF2018 and CF2016 was posted today:
Oracle JDK is now supported for Java 8 and Java 11 LTS – announced by Rakshith Naresh.
https://coldfusion.adobe.com/2019/01/oracle-java-support-adobe-coldfusion/
FYI Oracle has released Java Security patches… So Java 10 is now EOL and presumably vulnerable to security issues. This is really the worst for CF2018 customers because it ships with Java 10 and there is no security update for Java 10.
We have heard that there is a CF update for Java 11 support coming but this leaves the CF2018 customers in a bad place right now.
I’d also add some additional information for people worried that they will “run out of time” and be in violation of Oracle’s licensing on Jan 1st 2019. I was initially concerned about this, but it is not the case. If you are currently using, say, Oracle JDK8/11 on production, Oracle’s license that applied at the time you installed it is still valid and you will be ok to use a version of Oracle JDK8/11 that came out prior to Jan 1st forever with no issues. What you CAN’T do is upgrade to a newer version of Oracle JDK8/11 for free after Jan 1st 2019.
So, what is the risk to you on Jan 1st 2019? The risk is if a giant, horrible, no good security vuln comes out on Jan 2nd 2019, you would be unable to get the patch for free AND remain on an Adobe-supported version of Oracle JDK. Your choices would be as follows:
– Switch to one of the many supported (and possibly free) OpenJDK distros and potentially void your Adobe support of your installation
– Pay Oracle $$ to get a new version of Java covered under their subscription
IANAL (I am not a lawyer) and I urge you to read the Oracle licencing if you have questions, but much of my information has come from this document, which has become one of the definitive sources of information on the subject, and was written by some people who really know what they’re talking about:
https://medium.com/@javachampions/java-is-still-free-c02aef8c9e04
Here is an excerpt from the FAQ near the bottom of that article:
Q. If someone is using Oracle JDK 8 to run commercial software, after January 2019 do they need to purchase a license?No. The user can continue to use Oracle JDK 8 indefinitely without paying. The only cost is if they want to get updates beyond Jan 2019, in which case they will need to purchase an “Oracle Java SE subscription”.
Brad, you’re right about 8, but sadly not about 11, if you’re saying we don’t need to worry about using it free *for production*. We are not. The license agreement for 11 does clarify that.
See my blog post referred to elsewhere here, which I updated earlier this week to make this and another related point more clear (if you have read it before and didn’t catch this clarification).
So again, our only hope (for those who don’t want to pay Oracle) is that Adobe will support an open jdk (8 for cf2016 and below, 11 for cf2018) going forward–and preferably Amazon Coretto, with its longer support life cycle.
Or let me know if you think I still have things wrong.
Yes, thanks for catching that Charlie. I typed 8/11 intending to reference the versions of java that bundle with the CF11/2016 and CF2018 installer but I forgot that CF2018 never made it past CF10! Yes, you are correct that Oracle JDK11 has always been for development use only. I’ll edit my previous post to remove the “/11” references in order to not confuse anyone coming in.
Update: I guess i can’t edit my previous comment as it must be too old to edit so this reply will have to serve as a clarification to my accidental reference to Oracle JDK11 instead of Oracle JDK10 above.
So the interesting thing about CF2018 being on Oracle JDK10 is that suport for that actually ended last month (Sept) so CF2018 users are actually ALREADY in the boat that CF11 and CF2016 customer will be in on Jan 1st– stuck on a version of Oracle JDk with no more updates and unable to move to another supported JDK.
I think that goes to my original point though– there is no “shoe drop” moment where the FBI kicks down anyone’s door if they haven’t upgraded their server by a certain date. CF11, 2016, and 2018 users can continue to use the version of Oracle JDK that came with their ColdFusion installer without getting in legal trouble with Oracle. Adobe seems to be counting on the idea that nothing horrible will happen in the Java world before they get around to certifying new Java versions. However, if you work for an organization that requires you to be on supported versions of all your software (including Java), you’re going to be between a rock and a hard place in the meantime, and if you’re on 2018 you already are there.
Right, but it is important that people catch that if they DO use Java 11 for production (once cf2018 supports it), they COULD have Oracle sales thugs knocking on their door demanding a ransom–all because they didn’t notice the subtle indication in the Oracle license on the download page for Java 11 that it’s NOT licensed for free use in production. Caveat emptor.
FWIW, I’ll point out here that Suresh from Adobe did say in a forum post recently (https://coldfusion.adobe.com/discussion/2514693/) where he reported:
“The next update of ACF 2018 and 2016 planned for Jan/Feb 2019 will have support for Java 11 . The team is working on this as i write.”
As others asked there, this does not address CF11, nor does it address support of openjdk implementations. It would be helpful for someone from Adobe to update this post here with this clarification, or to create a new one that this one would point to.
We really need some kind of information here. We are down to a holiday filled month left to implement, test, get approval for, and deploy any solution that may be coming down the line. That’s not enough time as it stands.
Agreed. Adobe’s silence on this is astounding.
Well, they’ve not been “silent”, though I sympathize with everyone wanting to see more definitive statements from them, and ASAP.
Part of the problem is that the issue has been raised in various places here, both this blog post and in discussion/questions.
And in one of those other “discussions”, there was in fact an answer from someone at Adobe last week:
https://coldfusion.adobe.com/discussion/2514693/
See where Suresh says:
The next update of ACF 2018 and 2016 planned for Jan/Feb 2019 will have support for Java 11 . The team is working on this as i write .
Sadly, I can’t seem to get a link to go right to that comment of his. And of course, see the comments that follow.
And yes, it would be nice if they would put such info in both those other discussions and this one, which is more of a blog post supposedly keeping us up to date. Then again, the UI for these blog comments is such that if they MAY reply to someone here, it’s easily buried and the UI forces us to click on the replies to each message to see any. That’s frustrating. (You will see that the “discussion” I link to above does not have that same problem. All comments are presented, not hierarchically “buried”.)
Another challenge will be that they (Adobe) may offer a new blog post, to supplant this one. I have not seen one yet, but the new portal design doesn’t make it possible to see a list of ALL recent blog posts, in descending order of posting, to know for sure.
If a new blog post IS created by Adobe with more updated info, it would be VERY helpful for someone at Adobe to modify the body of this post to point to that newer one.
Any further updates? Time is running out
Some folks here have asked for more info on this matter. I posted a new entry with more, here:
This change in oracle’s policy toward commercial use of Java does definitely affect users of ALL versions of CF. See my post for more.
I then posted another entry on new openjdk jvm from Amazon called Corretto (and how it worked for me with CF in initial testing):
https://www.carehart.org/blog/client/index.cfm/2018/11/15/considering_amazon_corretto_open_jdk
As I note there, Adobe is not yet supporting it, and perhaps they will yet come out with some way that their licensing of the oracle jvm for redistribution will cover our commercial use of it. Time will tell.
Please share word of these posts if you think them important for others to know about
It is worth noting that Amazon will be providing a free long term support version of OpenJDK which that is used at Amazon “internally on thousands of production services“: https://aws.amazon.com/corretto/
You might wonder how does that differ from OpenJDK that is also free – the difference is Corretto will have Long Term Support (LTS) for each version – whereas OpenJDK will only get fixes in the latest version.
Just wanted to post that so people are aware of it, since it does look like an option I am looking into and hopefully using personally. It might even make sense for Adobe to switch to this JVM as the default in the future.
I would like to hear more on how this turns out.
Also, you ruined my weekend. I know what I am going to be doing Saturday
Wow, Pete At the very time you were sharing this here, I was posting a blog entry on corretto (and CF). For those interested in more, see:
https://www.carehart.org/blog/client/index.cfm/2018/11/15/considering_amazon_corretto_open_jdk
And I preceded that with another post with more on the whole oracle licensing issue, again for those wanting to know more
I will post a new reply here pointing to both at the top level of comments, as replies to comments are collapsed here in the portal and could be missed.
Please keep us informed with any updates as they come available pertaining this issue.
He is probably referring to this:
https://www.aspera.com/en/blog/oracle-will-charge-for-java-starting-in-2019/
Please post more on this when you can. We have a lot of people in my organization in panic mode.
Does this only apply to Java 11 though? So Java 8, as used by CF2016, can continue to be downloaded for free in commercial use to support future updates of CF 2016, particularly security patches in Java?
It will apply to Java 11 and later versions AS OF January 1, 2019. Java 8 will always be free, but it will be no longer supported by Oracle. If your company is fine running a version of Java that is technically no longer supported then you can continue to use it for as long as you wish.
Thanks Bradley. If Oracle are no longer supporting Java 8 then they won’t be issuing new security patches for it, right? That means there will be unpatched issues with CF2016 going forwards while it’s still officially supported by Adobe. I hope Adobe have a plan. Perhaps they can issue an update to make CF2016 compatible with Java 11 once they’ve done a deal with Oracle.
Gary – Oracle is probably selling extended support for Java 8, so they will probably continue to provide security updates to Java 8 customers that purchase Oracle Java Extended Support. They have done that for Java 7 and 6 when they ended core support.
Can you be more specific as to what Java changes you are referring to?
Oracle introduced license changes with the advent of JDK 11 https://forums.adobe.com/thread/2514693
There will only be paid support. The free version has to be replaced with the latest release every half year.
It would help if you linked to more details about what the change actually is, and talked about why it might be an issue (or not).
You must be logged in to post a comment.
23 Nov
10AM Pacific
Online
