Summary
It might seem easy to continue using Oracle Java continuously. When you pull back the covers, you find a never-ending cycle of Java upgrades. This hamster wheel is not as easy to navigate as it sounds.
In this post you will learn:
- If you’re using Oracle Java, you can avoid license fees if you stay on the latest LTS release
- There are only two years between LTS releases
- Every two years, you will need to upgrade your Java version to avoid license fees
- If you lapse onto an older version, Oracle will force you to pay license fees
- If you are using Oracle JDK 21, you have until September 2026 to upgrade to JDK 25 or start paying license fees
- Another option is to migrate to an alternative OpenJDK distribution
Java has evolved faster in the last six years than at any other time in its 30-year history. Behind this accelerated evolution is Oracle’s six-month Java version release cadence. Until recently, feature development drove the timing of new Java version releases, which created an irregular and slower schedule.
A consequence of this faster time-based release rate is that it is not practical to offer extended maintenance and support for all releases. This led Oracle to adopt its Long-Term Support (LTS) strategy. Thankfully, this has been adopted by all distributions of the OpenJDK, so there is one less consideration when selecting a Java runtime.
However, Oracle also made some strategic decisions about how they would license their JDK, resulting in challenges when considering what version of Java to use.
Since JDK 21, Oracle has provided its JDK under the No-Fee Terms and Conditions (NFTC) license. This grants the user a license to use the Oracle JDK, “…for the purposes of developing, testing, prototyping and demonstrating your applications, and running the Program for Your own personal use or internal business operations.” For most situations, this means you can use the Oracle JDK without needing to purchase a Java SE subscription (hence the “no-fee” in the license name).
Many users will be pleased that they can continue to use the Oracle JDK, with essential security and bug fix updates, at no additional cost. The problem of choosing a Java runtime is solved. Or is it?
Did Oracle solve choosing a Java runtime?
Organizations should note that the NFTC license does not apply for the entire lifetime of each JDK version. The NFTC license only applies until one year after the release of the next LTS version. At that point, the license will revert to the Oracle Technology Network License Agreement, which does not grant free use for internal business applications. Once this change takes effect, all subsequent updates will require a Java SE Subscription for most commercial use cases. Oracle prices the Java SE subscription using an employee metric, including part-time employees and contractors, and this can be prohibitively expensive.
One obvious solution is to upgrade your Oracle JDK to the next LTS release, which is still covered by the NFTC license.
This may sound straightforward, but is it really?
There are only two years between LTS releases since JDK 21. So every two years, you will need to upgrade your Java version.
The Java platform has maintained excellent backward compatibility, but there is no guarantee that this will work 100% of the time. The addition of new features sometimes (although rarely) impacts whether an application can run without changes. However, since JDK 9, new versions of Java have not only added new features, but have frequently removed old, little-used features. This has two advantages for the OpenJDK project: a reduction in the potential number of security vulnerabilities and a corresponding reduction in the maintenance overhead for the entire Java platform (with 7.5 million lines of code, this is a significant undertaking).
Thousands of end-user applications have been developed over the 30-year history of Java, and developers have been free to use all the features available in their release. You can’t assume that an application that works on one LTS version will happily work on the next.
| What does this mean if you are using Oracle JDK 21? |
|---|
| If you’re using Oracle JDK 21 and not paying license fees, you have until September 2026 to upgrade to JDK 25 or start paying Oracle license fees. As noted above, paying per employee – whether they use Java or not – can be extremely costly. |
What happened when Oracle removed the Security Manager from Java?
One recent example is the removal of the Security Manager from JDK 24. This might sound like Java is being made less secure, but the Security Manager in this context applies to the sandbox model used for running applets (which have not really been supported since JDK 10). However, some application developers saw this feature as applicable in non-applet, server-side enterprise applications, and duly used it as part of the application’s functionality.
Without an alternative feature provided, migrating an application that uses the Security Manager from LTS JDK 21 to LTS JDK 25 requires significant reworking of the codebase.
You should not assume that this will be the last feature that will be removed from the JDK.
How can you keep mission-critical Java applications updated?
When you switch mission-critical enterprise applications to a new version of the Java platform, you should run the full suite of tests available to ensure no differences in functionality. This can be a challenging task that requires considerable time and resources. Again, you must repeat this every two years, each time a new LTS version is released.
The assumption that moving to each new LTS version of Java is the easy option may prove false in the long run.
What are the challenges with upgrading Java every two years?
An alternative approach is to continue using the proven version of Java that was used to develop the application but update it quarterly to ensure the maximum level of security and stability. All without the need for potential recoding or extensive testing.
Azul’s Platform Core is a cost-effective alternative OpenJDK distribution. It provides all necessary backported security fixes and bug fixes. This is priced based on the number of cores or desktops being used, so it reflects the actual amount of Java being used. If you’re using Oracle Java 21, the clock is ticking. Why not give Azul Platform Core a try?
