After April 30, 2019, Adobe will no longer provide any updates for CF11, so there will be no security patches or hot fixes for CF 11 after that. Of course, updates for CF2016 will indeed continue into Feb 2021, while CF2018 updates will continue into July 2023. And we could expect CF2020 (when it comes) to by supported into 2025.
How do I know this? Where does Adobe say it? And can one buy support (yes) to "buy extra time to get such CF11 updates beyond April" (no)? And what about CF11 support for Java 11? Finally, could you use help in moving off CF11 to CF 2016 or 2018? For more on each of these, read on.
Where does Adobe document these "end of life" timeframes?
You can always keep up on the end of life for any Adobe products, ColdFusion and otherwise, at their "Products and technical support periods" (or "EOL Matrix") page. Note that they show there when each product was released, when its "core support" ends/ended, and when its "extended support" ends/ended.
That said, the page (which discusses ALL Adobe products, not just CF) doesn't really explain what "core support" or "extended support" are about (especially for CF users), nor does another Adobe page offered there, called "Adobe software end-of-life support guidelines" (also generic to all Adobe products).
What does the end of "core support" mean for CF11 users, regarding updates?
Fortunately, Adobe rep Elishia Dvorak (Technical Marketing Manager for CF) recently posted an entry in the CF portal where she DOES explain clearly what these terms mean, and especially what to expect regarding the end of updates for CF11, coming April 30: Adobe ColdFusion Support Policies and Options FAQ.
What she shares there applies also to other CF versions also: "Each release of ColdFusion includes five years of core support with an additional year of optional extended support" (CF11 came out in 2014), and this "includes quarterly hot fixes and security patches".
And the most important point (to me) is her clarification that "Extended support "DOES NOT INCLUDE security patches or hot fixes". So in other words, even paying for "extended support" (which is not free) does NOT mean that those on CF11 can continue to use it and get some inside track to special security patches/hot fixes that others (who don't pay) cannot get. She does go on to explain what one does get for that paid extended support, but my focus here is on the matter of security fixes, primarily.
Bottom line: After April 30, 2019, those running CF11 will no longer be able to expect Adobe to provide security patches or hot fixes.
Will CF11 be updated to support Java 11 (especially an OpenJDK 11)?
This is a separate (and as important) question, which Elishia's post does not clarify, so I can't offer any official answer on that (as of this writing). But for those with the question, I will say that I have found references to Adobe reps saying in online forums that CF2016 and 2018 WILL be updated to support Java 11 in Jan or Feb 2019, but CF11 was NOT mentioned (even though technically that is WITHIN the "core support" period). And those references to Adobe's plans about Java 11 have NOT clarified their plans regarding support for an open JDK 11 implementation.
If you wonder why any of this about Java 11 is an issue (even for those on CF2016 and 2018), see a previous blog post I did explaining that. The key points are these:
- Oracle will no longer offer updates for Java 8 for free (for production use) after Jan 2019
- Further, one cannot use the Oracle Java 11 JVM for for free (for production use). Those wanting to use anything (like CF) with Java 11 for production use (WITHOUT paying for the JVM) must use an OpenJDK implementation instead (of which Oracle's will be one)
- Oracle will support its OpenJDK implementation for only 6 months, while other parties are proposing to support their own openJDK implementations for much longer
- And so the questions for us using CF are: when Adobe will support Java 11 (and for what CF versions), and whether they will support an OpenJDK implementation, and which of those.
For more on all that, see my post What's an admin to do: Oracle's changed stance on production use of Java, going forward?. In that post I also point to an Adobe blog post from Raskshith discussing this (a bit) more, which interested folks should keep an eye on.
Crazy stuff about Java, right? We're living in interesting times regarding updating/using enterprise software, to say the least. Folks need to stay on their toes, and that's why I share what I do (and I can help you directly with such things via my consulting.
As for Adobe not yet clarifying things about CF support of Java 11 (as of this writing on Dec 20, 2018), whether you're on CF11 or 2016 or 2018, I'll add that there's no point complaining more/asking about that here. Instead, add your comment to Elishia's or Rakshith's posts above, where others have asked the same question and (again, as of this writing) there has been no answer. (Do keep in mind that it's currently Adobe's extended end-of-year holiday break, so there may not be an answer for some time.)
What about those running on Amazon's AWS AMI's?
Some may know that Adobe offers monthly-licensed AWS AMI's (Amazon Machine Images), and Elishia addresses that noting first that "Adobe ColdFusion Amazon AWS AMIs receive Platinum level support for core supported versions of ColdFusion", but then she does go on to clarify that "after the core support period is over, AMIs will not be refreshed." (Emphasis mine.)
So again, those on CF11 AMI's will also NOT get any security patches or hotfixes after April.
The bottom line: time to get off of CF11
So bottom line on all this: it's time to move off CF11 (however you may have it deployed, and regardless of what extended support you may have with Adobe), because after April there will be no more security patches or hot fixes. The problem is that there could be some important new security vulnerability (as there have been, even per the most recent updates to CF 11, 2016 and 2018) which could hit, and without Adobe updating CF11 you'll be in the same boat as those on CF10 (whose core support ended in May 2017) and earlier, who do NOT get the benefit of CF security fixes that have been released since its support ended.
Also, if Adobe doesn't update 11 to support Java 11, then you're going to FURTHER subject to security risks due to there being no further updates from Oracle to Java 8 (if you use it for production, unless you pay them).
So time to move up to CF2016 or 2018. You can see my various posts in the past on what's new in those (see related entries below). And again, I can help you make that transition via my consulting, though to be clear, not by moving updating your code for you, but by assisting you in that effort, guiding you to resolve migration and compatibility issues in such an upgrade.
Some great news is that while the move to CF10 or above from 9 or below was a big effort (because of the major changes in 10), and even upgrades to CF11 had quite a few issues, moves from 11 to 2016 or 2018 have generally gone much more smoothly. I document those issues in a a few slides in my recent talk on Hidden Gems in CF2018.
What's this ColdFusion 2020 you refer to?
Before ending, you may have caught that referred above to "CF2020 (when it comes)". Where did I hear about that? At the recent Adobe ColdFusion Summit (and other recent Adobe keynotes, such as at CFCamp and the Adobe CF India Summit), where CF Product Manager mentioned in passing that they are already working on the next release, CF2020. Great to see Adobe's continued support of CF, and indeed into the next decade.
Finally, if anyone reading this wonders "what about CF12 and CF13?", note that those are not the official names of CF2016 and 2018, respectively. They are names used (sadly) on some Adobe licensed software download pages, which is confusing.
As for all the above, comments are welcome, though if you only have something snarky to say about CF or those who use it (or Adobe), please refrain. This is a blog to help primarily those who DO use CF (though I often offer resources of help to those using Lucee, Tomcat, and indeed other Java app servers).
For more content like this:
- If you may prefer direct help, rather than digging around here/elsewhere or via comments, I can help via my consulting services
- See that for more on how I can help a) over the web, safely and securely, b) usually very quickly, c) teaching you as we go, and d) with satisfaction guaranteed