Considering making next ESAPi release require Java 11 or later as the minimal supported JDK

[kwwall]

In the next ESAPI release (tentatively, 2.7.0.0) , the ESAPI team is considering making Java 11 the minimal required JDK to use new versions of ESAPI. Java 8, which is currently the minimally supported JDK for ESAPI, is past EOL for the free support. (So is Java 11 for that matter, so perhaps we should just jump straight to Java 17?)

Anyhow, I'd like to here the ESAPI communities thoughts on this. The reason I'd like to move to at least Java 11, is during the past 3 to 6 months, I have seen many Java libraries decide to move to Java 11 or later (probably related to Apache Tomcat and Spring Framework and Spring Boot) and I don't want to put ESAPI in the position where someone EOLs a direct or transitive library dependency that ESAPI is dependent on. I'd like to get a bit ahead of the oncoming storm.

Thoughts?

[cuinan0]

When does your team plan to release this version?

[kwwall]

Unless we are forced to move up the time table by having our hand forced to go to Java 11 by some patched dependency fixing a CVE only supporting Java 11 or later (which is something that this discussion is all about), it likely wouldn't be until at least June/July 2025. I see no particular hurry, but I don't want to be forced to do this than have to scramble. Right now, it's mostly only affecting us in terms of Maven plugins and JUnit test dependencies.

What I am trying to do now is gauge the impact of how many companies, organizations, other FOSS projects, etc. this will effect because for whatever reason they are not able to use Java 11 at this point. That's what I'd like this discussion to focus on.

P.S.- I have from reliable source that data shows about 16% of the Java community still using Java 8, so it's a reason to be concerned. I hope that percentage is much lower for those using ESAPI, but who knows?

[cuinan0]

Although Jakarta EE is supported in esapi versions from 2.5.3.0 to 2.6.0.0. However, the version of Apache commons Fileupload that esapi depends on is 1.5, which does not support Jakarta EE.

The Apache commons Fileupload version should be 2.x. For example：

org.apache.commons
commons-fileupload2-jakarta
2.0.0-M1

Are there plans to implement this feature in version 2.7.0.0?

[xeno6696]

So FWIW, in the defense space I don't see anything less than 17 in use except in contracts for legacy programs, but those developers already know they're tied for life to lesser versions. I would say baselining to Java 17 would be the safe default for now, and then we should probably rethink our support cadence. Java versions are released ALOT more frequently than they used to be.