Are you still running CF11? Beware its countdown clock is ticking

Note: This blog post is from 2018. Some content may be outdated--though not necessarily. Same with links and subsequent comments from myself or others. Corrections are welcome, in the comments. And I may revise the content as necessary.

After April 30, 2019, Adobe will no longer provide any updates for CF11, so there will be no security patches or hot fixes for CF 11 after that. Of course, updates for CF2016 will indeed continue into Feb 2021, while CF2018 updates will continue into July 2023. And we could expect CF2020 (when it comes) to by supported into 2025.

How do I know this? Where does Adobe say it? And can one buy support (yes) to "buy extra time to get such CF11 updates beyond April" (no)? And what about CF11 support for Java 11 (no)? Finally, could you use help in moving off CF11 to CF 2016 or 2018? For more on each of these, read on.

(Update: I should note that Adobe did indeed offer one more update beyond April 2019, in June, when they updated CF2018 and 2016 as well for an important security update. That was a bonus. They have said there really will be no more CF11 updates, as per the original plan.)

Where does Adobe document these "end of life" timeframes?

You can always keep up on the end of life for any Adobe products, ColdFusion and otherwise, at their "Products and technical support periods" (or "EOL Matrix") page. Note that they show there when each product was released, when its "core support" ends/ended, and when its "extended support" ends/ended.

That said, the page (which discusses ALL Adobe products, not just CF) doesn't really explain what "core support" or "extended support" are about (especially for CF users), nor does another Adobe page offered there, called "Adobe software end-of-life support guidelines" (also generic to all Adobe products).

What does the end of "core support" mean for CF11 users, regarding updates?

Fortunately, Adobe rep Elishia Dvorak (Technical Marketing Manager for CF) recently posted an entry in the CF portal where she DOES explain clearly what these terms mean, and especially what to expect regarding the end of updates for CF11, coming April 30. The post's title seems more like that of a technote ("Adobe ColdFusion Support Policies and Options FAQ"), but it is indeed a blog post.

What she shares there applies also to other CF versions also: "Each release of ColdFusion includes five years of core support with an additional year of optional extended support" (CF11 came out in 2014), and this "includes quarterly hot fixes and security patches".

And the most important point (to me) is her clarification that "Extended support "DOES NOT INCLUDE security patches or hot fixes". So in other words, even paying for "extended support" (which is not free) does NOT mean that those on CF11 can continue to use it and get some inside track to special security patches/hot fixes that others (who don't pay) cannot get. She does go on to explain what one does get for that paid extended support, but my focus here is on the matter of security fixes, primarily.

Bottom line: After April 30, 2019, those running CF11 will no longer be able to expect Adobe to provide security patches or hot fixes.

Will CF11 be updated to support Java 11?

Update: Since originally writing this in Dec 2018, Adobe came out with new clarifications, so I am striking what I wrote and adding a new one.

Adobe did come out an update to CF2016 and CF2018 in Feb 2019, adding support for Java 11. That support was NOT added for CF11. And then had come out with a post in Jan 2019 asserting that they had reached a licensing agreement with Oracle, so that those using CF (any version) can get updates to Java 8 going forward (even for production use), and can use Java 11 in production (for those CF versions supporting it).

This is a separate (and as important) question, which Elishia's post does not clarify, so I can't offer any official answer on that (as of this writing). But for those with the question, I will say that I have found references to Adobe reps saying in online forums that CF2016 and 2018 WILL be updated to support Java 11 in Jan or Feb 2019, but CF11 was NOT mentioned (even though technically that is WITHIN the "core support" period). And those references to Adobe's plans about Java 11 have NOT clarified their plans regarding support for an open JDK 11 implementation.

If you wonder why any of this about Java 11 is an issue (even for those on CF2016 and 2018), see a previous blog post I did explaining that. The key points are these:

• Oracle will no longer offer updates for Java 8 for free (for production use) after Jan 2019
• Further, one cannot use the Oracle Java 11 JVM for for free (for production use). Those wanting to use anything (like CF) with Java 11 for production use (WITHOUT paying for the JVM) must use an OpenJDK implementation instead (of which Oracle's will be one)
• Oracle will support its OpenJDK implementation for only 6 months, while other parties are proposing to support their own openJDK implementations for much longer

For more on all that, see my post What's an admin to do: Oracle's changed stance on production use of Java, going forward?. In that post I also point to an earlier Adobe blog post from Raskshith discussing this (a bit) more, which interested folks should keep an eye on. (I have updated this in 2019 to point to the Jan 2019 blog post from Adobe.)

Crazy stuff about Java, right? We're living in interesting times regarding updating/using enterprise software, to say the least. Folks need to stay on their toes, and that's why I share what I do (and I can help you directly with such things via my consulting.

What about those running on Amazon's AWS AMI's?

Some may know that Adobe offers monthly-licensed AWS AMI's (Amazon Machine Images), and Elishia addresses that noting first that "Adobe ColdFusion Amazon AWS AMIs receive Platinum level support for core supported versions of ColdFusion", but then she does go on to clarify that "after the core support period is over, AMIs will not be refreshed." (Emphasis mine.)

So again, those on CF11 AMI's will also NOT get any security patches or hotfixes after April.

The bottom line: time to get off of CF11

So bottom line on all this: it's time to move off CF11 (however you may have it deployed, and regardless of what extended support you may have with Adobe), because after April there will be no more security patches or hot fixes. The problem is that there could be some important new security vulnerability (as there have been, even per the most recent updates to CF 11, 2016 and 2018) which could hit, and without Adobe updating CF11 you'll be in the same boat as those on CF10 (whose core support ended in May 2017) and earlier, who do NOT get the benefit of CF security fixes that have been released since its support ended.

Also, if Adobe doesn't now that they have clarified that they will not update CF11 to support Java 11, then you're going to FURTHER behind the curve, subject to security risks due to there being no further updates from Oracle to Java 8 if you use it for production, unless you pay them though at least with the recent Adobe/Oracle agreement you are at least covered fr updates to Java 8 beyond Jan 2019.

So it's beyond time to move up to CF2016 or 2018. You can see my various posts in the past on what's new in those (see related entries below). And again, I can help you make that transition via my consulting, though to be clear, not by moving updating your code for you, but by assisting you in that effort, guiding you to resolve migration and compatibility issues in such an upgrade.

Some great news is that while the move to CF10 or above from 9 or below was a big effort (because of the major changes in 10), and even upgrades to CF11 had quite a few issues, moves from 11 to 2016 or 2018 have generally gone much more smoothly. I document those issues in a a few slides in my recent talk on Hidden Gems in CF2018.

What's this ColdFusion 2020 you refer to?

Before ending, you may have caught that referred above to "CF2020 (when it comes)". Where did I hear about that? At the recent Adobe ColdFusion Summit (and other recent Adobe keynotes, such as at CFCamp and the Adobe CF India Summit), where CF Product Manager mentioned in passing that they are already working on the next release, CF2020. Great to see Adobe's continued support of CF, and indeed into the next decade.

Finally, if anyone reading this wonders "what about CF12 and CF13?", note that those are not the official names of CF2016 and 2018, respectively. They are names used (sadly) on some Adobe licensed software download pages, which is confusing.

As for all the above, comments are welcome, though if you only have something snarky to say about CF or those who use it (or Adobe), please refrain. This is a blog to help primarily those who DO use CF (though I often offer resources of help to those using Lucee, Tomcat, and indeed other Java app servers).

For more content like this from Charlie Arehart:

• Signup to get his blog posts by email:
• Follow his blog RSS feed
• View the rest of his blog posts
• View his blog posts on the Adobe CF portal

Need more help with problems?

• If you may prefer direct help, rather than digging around here/elsewhere or via comments, he can help via his online consulting services
• See that page for more on how he can help a) over the web, safely and securely, b) usually very quickly, c) teaching you along the way, and d) with satisfaction guaranteed