↓Skip to main content

Sdlc

Dependency Hygiene for Organizations

Programming Sdlc Security
The article discusses the importance of updating dependencies within software projects to maintain security, compatibility, and feature access, particularly in large organizations where outdated dependencies can lead to significant technical debt. It outlines strategies for dependency management to mitigate risks and enhance efficiency.

How Does New Oracle JVM Licensing Encourage Agility

Project Management Sdlc

What happened? #

Oracle has changed release and licensing policy for JDK:

  • The JDK still remains completely free for use. The thing that is changing is the availability of updates to specific versions of the JDK.
  • The only free for use in production JDK binary available from Oracle (as of JDK 11) will be the OpenJDK binaries. These will only have public security patch and bug fix updates for six months, until the release of the next version.
  • There is no free LTS release of the JDK from Oracle (for use in production).
  • Users can continue to use any binary of the JDK (the Oracle version or OpenJDK one) indefinitely. They will not, however, continue to get updates to these JDKs once public updates end.
  • Commercial users who want to continue to get security patches and bug fixes for JDK 8 or subsequent LTS releases after public updates have ended will have three options:
    1. Purchase a commercial support contract from Oracle.
    2. Use a different binary distribution of the OpenJDK, which has security patches and bug fixes backported to it.
    3. Create their own binary distribution from the OpenJDK source code and backport updates themselves.

How does it encourage agility? #

  • Most of the companies are not willing to purchase commercial support from Oracle.
  • At the same time, they need to get latest security updates.

So, what companies have to do –- is to upgrade JDK on production environments more frequently: at least every 6 months.