All,
I think the only safe way forward is to require jre 17 in tika 3.x's
tika-server and tika-server-standard. This would be on the next minor
release, say 3.4.0.
WDYT?
See: https://issues.apache.org/jira/browse/TIKA-4979 and
https://github.com/apache/tika/pull/3368
Best,
Tim
On Fri, Oct 9, 2026 at 3:03 PM Tim Allison <[email protected]> wrote:
>
> All,
>
> We never made an EOL for 3.x announcement. We're not held to any decisions.
>
> I was reminded today that CXF has stopped releasing 4.0.x. The last
> release was 4.0.11 in February. Branch_3x is on 4.0.11, so
> tika-server's CXF in Tika 3.x is effectively unsupported.
>
> ~Ten CXF CVEs were announced today.
>
> Jetty is in the same spot. Jetty 11 went end-of-life on 1 January
> 2025, and 11.0.26, which branch_3x uses, is the last 11.x artifact.
> Jetty 12 requires Java 17.
>
> CXF 3.6.x is still maintained on Java 11, but it's javax.*, and
> branch_3x is already on jakarta.*, so that's a namespace downgrade
> across 3.x, not a version bump.
>
> The only real fix is to move branch_3x to Java 17 and pick up CXF
> 4.1.x and Jetty 12.
>
> Ideas? Shorten the EOL for 3x or move to 17 in 3.x soonish?
>
> Best,
>
> Tim
>
> On Mon, Aug 24, 2026 at 12:11 PM Eric Pugh
> <[email protected]> wrote:
> >
> > 18 works. Honestly, any number *can* be changed in the future. You
> > wouldn’t want to do it capriocsly, but we aren’t bound to anything beyond
> > public perception.
> >
> > In a lot of ways, just communicating clearly the expectations is the key
> > thing.
> >
> >
> > > On Aug 24, 2026, at 10:57 AM, Tilman Hausherr <[email protected]>
> > > wrote:
> > >
> > > I'd concur with the highest number that other people who have a higher
> > > involvement are willing to accept.
> > > Tilman
> > >
> > > Am 24.08.2026 um 16:49 schrieb Tim Allison:
> > >> Makes sense.
> > >>
> > >> Tilman and Eric, is 18 months acceptable?
> > >>
> > >> On Mon, Aug 24, 2026 at 10:17 AM Tilman Hausherr <[email protected]>
> > >> wrote:
> > >>> Am 24.08.2026 um 15:58 schrieb Tim Allison:
> > >>>> What do others think?
> > >>>
> > >>> I'm always in favor of long maintenance times because of users bound to
> > >>> "old" jdk's.
> > >>>
> > >>> Tilman
> > >>>
> > >
> >
> > Disclaimer
> >
> > The information contained in this communication from the sender is
> > confidential. It is intended solely for use by the recipient and others
> > authorized to receive it. If you are not the recipient, you are hereby
> > notified that any disclosure, copying, distribution or taking action in
> > relation of the contents of this information is strictly prohibited and may
> > be unlawful.
> >
> > This email has been scanned for viruses and malware, and may have been
> > automatically archived by Mimecast, a leader in email security and cyber
> > resilience. Mimecast integrates email defenses with brand protection,
> > security awareness training, web security, compliance and other essential
> > capabilities. Mimecast helps protect large and small organizations from
> > malicious activity, human error and technology failure; and to lead the
> > movement toward building a more resilient world. To find out more, visit
> > our website.
