It has become clear to me, having spoken to many developers at many different events and seen recent postings on sites like Reddit, that there is still a lot of confusion about how the JDK will be delivered and updated in the future.
In this post, I’ll clarify, as concisely as possible, with references to the source of the information precisely how versions of the JDK and subsequent updates will be delivered in the future. This will aid developers in making decisions about future deployments of applications on the Java platform.
Oracle stated that their goal was to eliminate any functional differences between these two binaries. This will be complete with the release of JDK 11 in September. To achieve this goal, certain features (such as Flight Recorder and Mission Control) have been contributed to the OpenJDK project, whilst other features (like Java Web Start and JavaFX) are being removed from the Oracle JDK.
The impact on Java users of these changes can be summarised as follows:
The JDK still remains completely free for use. The thing that is changing is the availability of updates to specific versions of the JDK.
The only free for use in production JDK binary available from Oracle (as of JDK 11) will be the OpenJDK binaries. These will only have public security patch and bug fix updates for six months, until the release of the next version.
There is no free LTS release of the JDK from Oracle (for use in production).
Users can continue to use any binary of the JDK (the Oracle version or OpenJDK one) indefinitely. They will not, however, continue to get updates to these JDKs once public updates end.
Commercial users who want to continue to get security patches and bug fixes for JDK 8 or subsequent LTS releases after public updates have ended will have three options:
Purchase a commercial support contract from Oracle.
Use a different binary distribution of the OpenJDK, which has security patches and bug fixes backported to it. The Zulu OpenJDK binary is an example of this.
Create their own binary distribution from the OpenJDK source code and backport updates themselves.
A Java community-led project, AdoptOpenJDK, has been started to produce free OpenJDK binaries. At the time of writing, this project is able to build binaries directly from OpenJDK source but has not determined who will undertake the (potentially complex) task of backporting updates from the current release to older versions.
Azul’s Zulu distribution of OpenJDK is free but can also be delivered under a commercial support contract with agreements on the availability of updates as well as 24x7x365 or 8×5 support. Pricing for this is very reasonable compared to the other options.
Given that JDK 8 public updates will end at the start of next year users should be actively considering how they will ensure current and future deployed JDK versions are maintained for security and stability.