I agree across the board. Let's get a 2.2.0 release out with recent changes, features and security fixes then target a 3.0.0 for java 17+.
Thanks for bringing this up, Phil! On Mon, Apr 7, 2025 at 4:14 PM Sandeep Moré <moresand...@gmail.com> wrote: > Thanks for starting this thread Phil! > > We did some work to support running Knox on Java JDK. I recall a few issues > with compiling but those were mostly due to our intent of supporting JDK 8. > Moving away from JDK 8 would help us a lot especially regarding Pac4J and > spring upgrades. > > I think we would need a major Knox version for JDK 17 given this would be a > breaking change. > > About releasing multiple versions, although I do not like the idea but I > think it would be nice/necessary if we release one last version with CVE > fixes for folks to give them some runway to upgrade. > > Just my thoughts :) > > Best, > Sandeep > > On Mon, Apr 7, 2025 at 3:59 PM Phil Zampino <pzamp...@apache.org> wrote: > > > With Java 8 and 11 EOL approaching, and the associated limitations we've > > encountered wrt upgrading some dependencies, it seems about time to move > > the Knox project to a more current Java version. I propose we begin > > development compiling with Java 17, and drop support for Java 8/11. This > > will not be trivial, but will require some significant changes to the > > source. > > > > Would such a change constitute a major Knox version increment (e.g., > > 3.0.0)? > > > > Should we release one more version (e.g., 2.1.1) based on Java 8/11? > > > > Interested in your thoughts, > > Phil > > >
