[Please note that I am tweaking this post, now several months after its release. Unfortunately, the CF Portal makes any edited post appear on the front page, as if it was just created. So I offer this statement to help avoid confusion.]

CF users will want to note that Oracle has released new updates to Java 8 and Java 11 this week, on April 16, 2019. As usual, they contain important security updates and bug fixes. The latest updates are now 11.0.3 and Java 8u211 or 212. As for what those updates entail, see the release notes for each available on the Java release notes page. (And if you find this post in the future, and wonder about still later updates to Java, that page will help also.)

For some users, that’s all they need to know. They can take that ball and run with it.

But from my experience, many people will inevitably (and understandably) have more questions. For answer to those, read on.

Overview

Updating CF to use a new Java version is pretty simple, in concept in practice. But there are some nuances that need to be considered and understood. As I help people implement such Java and CF updates on this portal and the CF forums, as well as in my remote server consulting services, I see these sort of questions about daily.

While folks on twitter, slack, and stack overflow may favor short answers, some of the questions have more subtlety than many realize, so I hope you will benefit from the longer-form elaboration. 🙂 I will address here the following common questions:

• Which Java can I use with the version of CF I have installed?
• If I’m using Java 8, should I choose the update 211 or 212?
• Am I really able to use Java 11 (and Java 8 updates after 202) in production?
• Where can I download the Java updates?
• How do I update the Java that CF is running?
• What if I have problems updating the Java that CF uses?
• What if I have problems applying the CF update (so that I can run Java 11)?

Which Java can I use with the version of CF I have installed?

Which version of Java you can use (8 or 11, or higher) depends on what version of CF you are using, and also what CF update has been applied to that CF instance. Again, as for how to install a new or updated Java version and tell CF to use it, I cover that in a later question here.

In brief, Adobe has always supported using the latest Java update (point release) of a major Java version which is supported by that version of CF.  That phrase can easily confuse folks, so read on for how that works out practically for you.

First, to be clear, at the time of this writing (Apr 2019), no version of CF currently supports Java 12 (released in March 2019).  Update: In Sept 2019, Adobe released support for Java 12, for CF 2018 and 2016, and I have updated the table below to reflect that. I also have a post on why you should probably NOT update to Java 12 for use with CF, since it was EOL before the CF support was released.

As for Java 11 and earlier, read on.

If you are on CF2018, then as long as you are on its update 2 or later (released Feb 12 2019), you can use Java 11 and this latest update. (Note also that CF2018 came originally bundled with Java 10, and then in Feb a new installer was released that came with Java 11.0.0. You can install and tell CF to use Java 11. To be clear, Oracle is no longer updating Java 10, as it was a short-term release.) As for Java 8, CF2018 is not designed to use that: it’s not listed as supported in the CF2018 System Support Matrix document.

If you are on CF2016, then as long as you are on its update 8 or later (also released Feb 12, 2019), you can use Java 11 and this latest update. (While CF2016 came with Java 8, no new installer was made available that bundles Java 11 with it.) Otherwise, as for Java 8, users of CF2016 (at any update level) can use this latest Java 8 update.

If you are on CF11, then as long as you are on its update 3 or later (released Dec 2014), then you can use Java 8 and this latest update. The original installer for CF11 came with Java 7 bundled. Later installers came with Java 8 bundled. As for Java 11, it is not supported for CF11. To be clear, I am saying that Adobe did not update CF11 to support Java 11, when it updated CF2016 and 2018 to support it in Feb 2019, even though technically CF11 is “supported” until April 2019. It is what it is.

If you are on CF10, then as long as you are on its update 14 or later (released Oct 2014), then you can use Java 8 and this latest update.

CF9 and earlier were never updated to support Java 8 or later. But I will note that some people have changed CF to point to Java 8 (for some feature it added), and for most things “worked” while for others it did not and they had to revert (or were forced to upgrade to a newer CF version that supported it.)

Here’s a table of CF versions and the Java versions they support, summarizing the above (including the Sep 2019 update regarding Java 12). If you may want to link to this table to share with others, here is a direct link to it:

For those who may have been directed to this post with a link right to this table, you may want to go back to the top to see the many points addressed in this post, related to this latest set of Java updates, which may also benefit you.

And for more on the Java versions supported by CF 11, 10, 9 or earlier, see this Adobe blog post from that 2014 timeframe. For more on Java 9 and 10, if these may be “new” to you, see a post I did several months ago (before Java 11 was released).

If I’m using Java 8, should I choose its update 211 or 212?

While with Java 11 there is only one updated version each time it comes out, with JAva 8 (and earlier) there have in recent years been this pair of two updates each time a new one comes out. What’s the difference?

Basically, it’s that the higher number adds both the latest security updates AND bug fixes/changes, the lower number adds only the latest security fixes–but it also adds the bug fixes/changes from the previous update. So for instance, if one went to update 211, it would have the latest security fixes and ALSO the bug fixes/changes (and of course security updates) from update 202, which had been released a few months ago.

The intent is that for those who may want to only get “needed security fixes” and not have any risk from “unneeded bug fixes”, they can do that by installing the lower of the two current version numbers–letting others deal with the fallout of possible problems from those bug fixes/changes. Again, though, they WILL get those “skipped” bug fixes/changes when they apply the NEXT update.

This is explained more in an Oracle technote from the CF7 era. While the terms used then to distinguish the two variants were “CPU” (critical patch update”) and “PSU” (“patch set update”, the concept is the same.

Note that in the more release notes, like those linked to earlier here, they use the newer terms GA (“general availability”) and BPR (“bundled patch release”). They’re the same concept, but they add a new dimension: the BPRs are only for those who have licensed Java while the GAs are for those who have not. That said, this notion of “licensing java” is indeed new and different for Java 11 and JAva 8 after Jan 2019. See additional discussion of that, relative to CFers, in the next question and answer.

Bottom line: its your choice. I see most CF users take the higher of the two numbered updates, to get the bug fixes. But if they prefer to wait on them, they can (by taking the lower number).

FWIW, with CF, we only get one update that includes both bug fixes and/or security updates. I have wondered myself if Adobe might adopt this approach, as it could have helped with the Feb 12 updates, which had both security updates AND bug fixes/changes, and the latter caused problems (fixed by a replacement update several days later). Sadly, those needing ONLY the CF security updates had no choice but to get the update (while there was trouble with it) or wait for the fix.

Am I really able to use Java 11 (and Java 8 updates after 202) in production?

As you will see, if you visit the Oracle Java site, there’s a new sheriff in town…er, I mean, there’s new rules in place about who can and cannot use Java “for free”. Bottom line, as of Java 11 and for Java 8 updates after Jan 2019, use of Oracle Java in commercial environments requires paid licensing of Java. Yikes.

But Adobe has us covered. They announced in January that they have licensed Oracle Java for those using CF (all versions of CF and Java).

I have much more to say on this from a blog post I did back last year, when the news about Java had been released but Adobe had not yet clarified things. It’s moot now, at least for CF users. But it still applies for those using Java otherwise (and for Lucee users), so read on if you’d like more detail.

Time to buy Oracle stock, perhaps, as the licensing and sales folks catch folks unaware of all this, like “shootin’ fish in a barrel” , to continue my colloquialism from above.

Where can I download the Java updates?

This is where things get interesting. So some people are asserting that with the change of licensing, one should ONLY be getting the new Java installers from Adobe, and if you’d not noticed it, they did add a new section to the bottom of the CF downloads page, offering Java installers. And it was 11.0.2 and Java 8u202 (not 201, I might add).

But they don’t (as of today) have 11.0.3, and it would seem they’d go to 8u212 (not offering 211). You can find those from the Oracle site, for Java 11 and for Java 8, though you do need to have an Oracle account. I have a free one, and have been able to login and access these updates.

Should you really only download them from Adobe, as some assert? Well, I can say that I had compared the installers on the Adobe site to the Java site, and they were binary the same. So your call.

How do I update the Java that CF is running?

So now we’re moving beyond “what you need to do” to “how to do it”, and I certainly don’t want to make this post any longer than needed. I will point out that there are various resources out there on the web, from Adobe and others, going over how to install Java and point CF to that new Java. (I will clarify that you should not tell Java to install INTO the same jre folder under CF. Leave that there, and install Java elsewhere, then point CF to that.)

I will point out Pete Freitag did a recent blog post on the topic, so check out his post and the video offered as well for more details.

What if I have problems updating the Java that CF uses?

If you follow Pete’s steps, all should go well. But if you have problems, or want to prepare to avoid them, I did a post in recent years addressing the several problems that can EASILY go wrong when trying to update the JVM that CF uses. See that for more: CF911: ‘Help! I’ve updated the JVM which ColdFusion uses, and now it won’t start!’

What if I have problems applying the CF update (so that I can run Java 11)?

Finally, since I do also mention how you may need to update CF itself (from one update to another, within the same CF version), before it will support Java 11, I will note that I also had done a couple of blog posts on dealing with problems related to doing THAT update. First is a rather short post, on the key importance of looking in the update log, if you have trouble after a CF update: Having problems after applying a CF update? What to check, and how to recover!

Second is a longer post I did (long before that) on my own site: How to solve common problems with applying ColdFusion updates (in 10 and above)

Or I can help you with things like these updates

I really hope that with the above info, you may be able to take this ball and run with it. And for nearly all the 40+ blog posts I’ve offered here on the CF portal, I’ve not made mention of the fact that if you need or would like help doing any of this, this sort of work is what I do for a living, helping folks with things like this, remotely, securely, and quickly.

And you don’t need to give me remote access (or create an account on your server, or open a firewall). Instead, I would do it via screensharing (like webex, gotomeeting, join.me, etc.), which I can offer or we can use your own (and you can record it then, if you’d like).

And I can generally help update CF to use a new Java version in less than 15 minutes. Same with applying a CF update. All this while you watch, and indeed my preference is to guide you through the process, so that you learn and eventually don’t need me any more.

If you would like this sort of help, for these updates or about any problem related to CF, I can help: whether updating CF or Java, or upgrading/migrating to a new CF version, as well as installation/configuration/administration of CF or troubleshooting/tuning, or security, and more. Helping is what I do.

And your satisfaction is guaranteed. You won’t pay for time you don’t value. More (including rates) at carehart.org/consulting.

One more time, before someone cries foul about a “sales pitch”, I have not mentioned the above in 40+ blog posts here. I mention it here because changing the JVM or updating CF can indeed be a challenge for people, even if they are confident and skilled in the task, if they are caught by something unexpected. I have given here (and especially in my other posts I’ve linked to) ample info for people to be able to make such a move on their own. But the offer of help is simply for those who may need it. If that’s not you, thanks for reading to this point.

Conclusion

So there you have it: the fact that there’s a newly available Java update, as well as some key additional points on whether, how, when, and even why to apply the update. 🙂 Next time there’s a new JVM update, I can offer a briefer post (with just the info like at the top here), and I can point readers to this for all the other gory details!

If you have questions or comments, they’re welcome below.

For more blog posts from Charlie Arehart, see his posts here as well as his posts at carehart.org. And follow him on Twitter and other social media as carehart.