All,
We never made an EOL for 3.x announcement. We're not held to any decisions.
I was reminded today that CXF has stopped releasing 4.0.x. The last
release was 4.0.11 in February. Branch_3x is on 4.0.11, so
tika-server's CXF in Tika 3.x is effectively unsupported.
~Ten CXF CVEs were announced today.
Jetty is in the same spot. Jetty 11 went end-of-life on 1 January
2025, and 11.0.26, which branch_3x uses, is the last 11.x artifact.
Jetty 12 requires Java 17.
CXF 3.6.x is still maintained on Java 11, but it's javax.*, and
branch_3x is already on jakarta.*, so that's a namespace downgrade
across 3.x, not a version bump.
The only real fix is to move branch_3x to Java 17 and pick up CXF
4.1.x and Jetty 12.
Ideas? Shorten the EOL for 3x or move to 17 in 3.x soonish?
Best,
Tim
On Mon, Aug 24, 2026 at 12:11 PM Eric Pugh
<[email protected]> wrote:
>
> 18 works. Honestly, any number *can* be changed in the future. You
> wouldn’t want to do it capriocsly, but we aren’t bound to anything beyond
> public perception.
>
> In a lot of ways, just communicating clearly the expectations is the key
> thing.
>
>
> > On Aug 24, 2026, at 10:57 AM, Tilman Hausherr <[email protected]> wrote:
> >
> > I'd concur with the highest number that other people who have a higher
> > involvement are willing to accept.
> > Tilman
> >
> > Am 24.08.2026 um 16:49 schrieb Tim Allison:
> >> Makes sense.
> >>
> >> Tilman and Eric, is 18 months acceptable?
> >>
> >> On Mon, Aug 24, 2026 at 10:17 AM Tilman Hausherr <[email protected]>
> >> wrote:
> >>> Am 24.08.2026 um 15:58 schrieb Tim Allison:
> >>>> What do others think?
> >>>
> >>> I'm always in favor of long maintenance times because of users bound to
> >>> "old" jdk's.
> >>>
> >>> Tilman
> >>>
> >
>
> Disclaimer
>
> The information contained in this communication from the sender is
> confidential. It is intended solely for use by the recipient and others
> authorized to receive it. If you are not the recipient, you are hereby
> notified that any disclosure, copying, distribution or taking action in
> relation of the contents of this information is strictly prohibited and may
> be unlawful.
>
> This email has been scanned for viruses and malware, and may have been
> automatically archived by Mimecast, a leader in email security and cyber
> resilience. Mimecast integrates email defenses with brand protection,
> security awareness training, web security, compliance and other essential
> capabilities. Mimecast helps protect large and small organizations from
> malicious activity, human error and technology failure; and to lead the
> movement toward building a more resilient world. To find out more, visit our
> website.
