{"id":32617,"date":"2020-05-01T14:59:00","date_gmt":"2020-05-01T14:59:00","guid":{"rendered":"https:\/\/foojay.io\/?p=32617"},"modified":"2021-08-23T12:15:26","modified_gmt":"2021-08-23T12:15:26","slug":"dashboard-for-openjdk-update-release-details","status":"publish","type":"post","link":"https:\/\/foojay.io\/today\/dashboard-for-openjdk-update-release-details\/","title":{"rendered":"Dashboard for OpenJDK Update Release Details"},"content":{"rendered":"\n

Java is a well-maintained development and deployment platform.  Through the OpenJDK project<\/a>, regular updates to production releases follow a traditionally established schedule.  On a specific Tuesday in January, April, July and October, a set of updates are published covering security-related issues as well as bug fixes and even minor enhancements.  Regular updates have been a long-standing tradition for Java.  The update cadence has been a long-standing tradition for Java and is relied on by those responsible for ensuring Java-based systems are kept up to date and secure.<\/p>\n\n\n

Changes and bug fixes are most often initiated in the upstream, still-in-development or major OpenJDK versions, and then backported through a community effort to the already released OpenJDK versions which most of the world uses in production. In addition, security updates are confidentially coordinated through the OpenJDK Vulnerability Group<\/a>, such that vulnerabilities, CVEs<\/a>, and source code for sensitive fixes can all be revealed simultaneously on the coordinated update date across all maintained versions. The specific update projects, for example, OpenJDK 7u, 8u, 11u and 13u, regularly update in this manner.<\/p>\n\n\n

Over 560 Fixes in April 2020 Update<\/h4>\n\n\n

Much detail is involved in these updates. Their contents are publicly visible and documented via the OpenJDK projects and associated Java Bug System (JBS)<\/a>, and textual list of all issues that are resolved in a given update is generally posted to OpenJDK project mailing lists.  Using the April 2020 update as an example, there were over 560 issues listed in the release notes across the various maintained versions.  These varied from introspective details such as build related issues and test updates to documentation corrections, through fixes to actual behavior affecting bugs, and all the way up to multiple security fixes associated with CVEs bearing high severity CVSS scores. <\/p>\n\n\n

For Java users and developers who depend on OpenJDK builds, finding the relevant highlights of a given update and how they may improve or otherwise impact deployments is no small task.  Separating issues that have significance to a user from others would involve going through hundreds of individual issues. Following each into the Java Bug System to review details, and deducing relevance for one\u2019s environment can be quite a challenge. In practice, few Java users or organizations will go through this level of effort.<\/p>\n\n\n

This is where foojay\u2019s user-focused Java and OpenJDK update descriptions come in<\/a>.<\/p>\n\n\n

The User\u2019s Perspective Matters<\/h4>\n\n\n

When looking at the highlights, the user\u2019s perspective matters. There is a material difference between the importance and impact on Java deployments and the notion of what \u201cpriority\u201d is for issues in the Java Bug System. The issue notes and material circulated on OpenJDK lists tend to center, for good reason, on the needs and concerns of developers who build and maintain OpenJDK.  The notion of priority in the JBS focuses on OpenJDK development, timeline, and urgency, and not on their value or eventual impact. In fact, an inverse relationship often exists: Some of the most important and impactful items in OpenJDK updates in recent years were categorized as lower priority in the JBS.<\/p>\n\n\n

A great example of this difference in perspective can be found in\u00a0JDK-8146115<\/a>, \u201cImprove docker container detection and resource configuration usage\u201d.\u00a0 This new capability, which was first introduced to OpenJDK 8 with the 8u192 update, is arguably one of the most meaningful improvements to Java\u2019s execution in a container environment in recent years. But in the JBS it is classified as an enhancement with a P3 priority.\u00a0 The change fundamentally altered (and significantly improved) how Java works in containers.\u00a0 Before the number of cores the JVM detected (and made available to the application) was driven by the size of the machine rather than by the (typically much more stringent) \u00a0limitations imposed on a container, which would often lead to frequent thrashing and throttling situations. Obviously, it would be hard for a Java user to deduce the importance of this item, or even to notice it (given its low priority categorization) by skimming through the tens of other items OpenJDK 8u dev list update notes. (More on this topic is here, by Ray Tsang.<\/a>)<\/p>\n\n\n

Java Technologist Dashboard<\/h4>\n\n\n

Going forward, a clearer perspective of what changes a Java update contains is now provided at foojay.io<\/a>. Foojay\u2019s user-focused Java and OpenJDK update descriptions offer a dashboard with updated analysis, selected highlights, and categorized lists of updates arranged for consumption by Java users. <\/p>\n\n\n

Working together with Java enthusiasts around the world, the foojay team works to identify critical aspects of each new OpenJDK update when it is released and bring to the fore precisely the issues that have value and relevance to those that use Java throughout the industry.<\/p>\n\n\n

\"\"<\/figure>\n\n\n

For example, in the April 2020 update, foojay chose to highlight two P4 issues that might otherwise not be given the prominence they deserve and be lost in the noise:<\/p>\n\n\n