As for CF2021, it gets updates into 2025, and the currently running pre-release of CF2023 is a great sign for the continued vitality of CF. But this looming deadline for CF2018 is a reminder that as the years roll on, we not only get new versions but we must say good-bye to old ones.

Wondering what you can do? or when CF2021 or CF2023 support will end also? And what's the difference between "core" and "extended" support Adobe sells? (The extended support plan does NOT provide updates beyond this coming July.) For more on these, including official Adobe documentation that discusses such things, as well as my thoughts on migration, costs, various options to consider, and more, do read on.

The various core support end dates for CF and CFBuilder versions

As you may know, ColdFusion versions follow an approximate 5-year cycle, from release to end of "core" support, with an extra year of "extended support" (which again does NOT include updates).

Here are the dates for the few most recent ColdFusion (and ColdFusion Builder) versions, from the Adobe corporate "eol matrix" page (which shows dates of even older CF versions).

(Since CF2023 is still in prerelease, it's not offered there as I write this post. Similarly, the new CF Builder for VS Code is not listed, perhaps since it's free.)

What can you do at this point?

Folks running ColdFusion 2018 (the audience for this post) who are interested in staying as up to date as possible (for as long as possible) should consider buying and moving your apps to run on CF2021, as its updates will be offered for 2 more years (Nov 2025, 5 years after it came out in Nov 2020). And when CF2023 comes out, that will be another option to consider of course.

Here are a few more thoughts that may help you if you're in this situation (of running CF2018 or even earlier):

• Note first that you don't need to pay Adobe anything to begin testing with a new version. With CF, you can always install it (on the same or another machine) choosing to use either the free Developer edition/license (which has no expiration date) or the 30-day trial (which reverts to the Developer edition if you don't put in a valid license key before then). You are asked during installation of CF whether to run as Developer, Trial, or to put in a license key. You can also add a license key in the CF Admin after installation.
• You also don't need to make an "all at once" switch from one CF version to another. As with any CF version, you can run CF2021 alongside of a CF2018 installation (or a CF2016 installation, and so on). As long as the current version is running when you install another, the new one gets different ports so that both can even run at the same time (as long as your machine has the resources).
  • You can even configure the web server connector (for IIS or Apache) to allow some sites to run on one CF version while another site/s run against another CF version. For some folks, that's trivial to do, while others may struggle. I can help you directly with that if interested, usually very quickly (as in minutes).
• As for migration of your app from earlier versions to CF2021, I cover most of what you need to know in a (recorded) talk on Migrating apps to ColdFusion 2021 from earlier versions, or again I can help you directly.
• As for the cost to upgrade, note that Adobe offers an upgrade discount to the current version from the preceding version, so there is an upgrade discount to move from CF2018 to 2021. Buying CF2021 now will also allow you to get that upgrade discount on moving to CF2023 when it comes out.
  • If you may still be running CF2016 or earlier, Adobe offers no upgrade discount to CF2021 for you. But note that the FusionReactor folks (also CF resellers) have a deal on until Feb 28, where you CAN get an upgrade discount to move to CF2021 from CF2016 or earlier. See my post with more info on that deal.
• Some folks find this sort of deadline makes them all the more interested to consider the prospect of moving to the open-source CFML engine, Lucee. It's not from Adobe, and it doesn't claim complete compatibility with CF, but as an ecosystem and community (and especially for scaling), many have found it to suit their situation and be worth the migration effort (which like the from even any one version of CF to another may range from trivial to seemingly impossible).

Finally, for those still on ColdFusion 2018, again if you see that 2024 date for CF2018 "extended" support you can buy, please note Adobe has clarified that "extended support" "DOES NOT INCLUDE security patches or hot fixes" but rather "best-effort support intended to assist customers in migration to a core supported version ". So it's about "supporting you" in your migration effort. The paid "extended support" does NOT get you updates and fixes to CF2018 beyond Jul 2023.

Yes, I've repeated that point and underlined it now multiple times, because some people mistake what that table means, if they even see it.

"Do I really need to worry about no longer getting CF updates for CF2018 after July 2023?"

Yes, you do.

Let's clarify: the updates which Adobe offers (usually about 15-20 over the 5 year life of each CF version) address bug fixes, and sometimes change or add features, but most important these CF updates often provide security fixes--fixes to known vulnerabilities that are discovered and rectified by applying the latest updates.

Once Adobe no longer offers updates for the version you're on, you are at considerable risk. When the first set of updates come out after July 2023--for the versions of CF still under support--the fixes in those updates will NOT be back-ported to the CF versions no longer supported, again even security fixes. And that could happen any time after July 2023.

Of course, some people drag their feet. Change is hard. Upgrading apps can seem scary (perhaps it was terrible in some prior attempt). Again, I offer a presentation covering migration to CF2021 from older CF versions. Or again I can help you directly, usually with very little effort on my part to help get you over your humps, while you/your folks proceed with testing and making any needed changes (which can range from none to seemingly "too many", but it's usually somewhere in the middle.)

And sure, some folks opt not to upgrade because they have plans "to migrate off of CF entirely", and sometimes that turns out to be far more challenging for them than originally planned.

There are many today who made such choices years ago and are still running even CF2016 (which was last updated in 2021), or CF11 (last updated in 2019), or CF10 (last updated in 2017), and so on.

Such folks are playing a game of Russian roulette by remaining on a version no longer getting updates. There could be vulnerabilities that were fixed years ago in later CF versions, even if you may feel you have "gotten by so far without a scratch".

Indeed, the threat landscape is constantly changing. To be clear, there have been multiple security updates even to CF2021 and 2018 alone, as vulnerabilities are found either in CF, Tomcat, or related libraries that CF may include--indeed the most recent updates to each of CF2021 and 2018 (in Oct 2022) included a security update. Adobe works hard to keep on top of things (even if some may feel it's "not fast enough" or even "not often enough").

How might things change about moving to CF2021 once CF2023 comes out?

Before wrapping up, maybe you will see this post and be unable to get your folks to make the move to CF2021 now. But the end-of-life for CF2018 is not the only "ticking" clock. As I said, CF2023 is in prerelease now as I write, and while there's for now no information about its release date, pricing, feature set in Std vs Ent, etc. since it's in prerelease, we can expect it should come out in coming months.

Once CF2023 DOES come out, there are some things that should change about the prospect of moving to CF2021, which relates to folks still on CF2018. Many seem unaware of these things, so I want to give you a heads-up of how they have gone in past releases:

• Once CF2023 comes out, we should expect that Adobe will no longer offer CF2021 at all on their site, for sale or for download. Again, CF2021 WILL be updated into 2025. You just won't be able to buy it once CF2023 comes out, or even download it from Adobe. (So if you want to get it now, "just in case", note that I have a post from a few months ago on how you can get a CF2021 installer that includes the most recent update 5. Save it the download now to use it when you may get to wanting to try CF2021 later, but it's no longer offered by Adobe.)
• And what if you DO WANT to buy and run only on CF2021 (but not CF2023) after CF2023 comes out? We should expect the situation to again be the same as it was for CF2021, CF2018, and 2016 etc. There should be provision for you to buy CF2023 and do a "backward licensing" to CF2021: they will give you a CF2021 license to use with CF2021, disabling your 2023 license.
  • And my understanding is that if you later DO want to start running on CF2023, you will have to buy an upgrade to it--as what you "paid for" was in essence CF2021.
  • Yep, it's all a bit convoluted. The best I can offer is that CF backward licensing was discussed in a 2016 Adobe CF blog post explaining things, with comments in 2018 that said this would apply to CF2018 as well. (FWIW, there is also an Adobe KB article on backward licensing of CF, whose wording seems unchanged since that post in 2016--and sadly still has dated references to CF10, 11, and 2016.)
  • That said, I've heard since that if you later DO want to start running on that "new version you bought" (CF2023 in this case), you will have to buy an upgrade to it--as technically what you "paid for" was in essence the version you backward licensed to: CF2021, in this case.
  • Finally, you'll see discussed in those resources how there's also the matter of HOW you buy the new version license (CF2023, in this case), as to whether it can even BE "backwards licensed". It turns out you CANNOT backward license if you buy CF from the main CF web site. Most of the resources above indicate you need to buy a "volume license", but there's no clarification on what that is or how to get it. Instead, they offer email addresses for you to follow up if interested.
  • But finally, see the comments from me in that blog post where Adobe replied confirming then that by buying CF through a reseller you WOULD be able to get that backward license opportunity. Again, Intergral (makers of FusionReactor) are one such CF reseller.

The bottom line

The bottom line is that if you want to be able to get ongoing security updates and hotfixes for your CF beyond Jul 2023, you will need to upgrade to CF2021 (or CF2023 when it comes out). You should be planning NOW to upgrade your apps from CF2018, or accelerate your plans to move off of CF entirely if that's the plan.

I'll add that I can help people, whatever version of CF (or Lucee) they are on, and whether with troubleshooting/tuning, or updating/upgrading/migrating versions, leveraging new features, security, containerized deployment, and more.

Hope this news has helped folks still on CF2018 (and even those on earlier versions).

For more content like this from Charlie Arehart:

• Signup to get his blog posts by email:
• Follow his blog RSS feed
• View the rest of his blog posts
• View his blog posts on the Adobe CF portal

Need more help with problems?

• If you may prefer direct help, rather than digging around here/elsewhere or via comments, he can help via his online consulting services
• See that page for more on how he can help a) over the web, safely and securely, b) usually very quickly, c) teaching you along the way, and d) with satisfaction guaranteed