smlambert
commented
8 months ago I have removed arm32 from JDK21 table, as per PMC decision to drop it for that version and upwards (related: https://github.com/adoptium/adoptium-support/issues/962).
Closed Haroon-Khel closed 7 months ago
smlambert
commented
8 months ago I have removed arm32 from JDK21 table, as per PMC decision to drop it for that version and upwards (related: https://github.com/adoptium/adoptium-support/issues/962).
jerboaa
commented
8 months ago I have updated the version numbers in the table. Version numbers for January are: 8u402, 11.0.22, 17.0.10 and 21.0.2.
Haroon-Khel
commented
8 months ago I've removed aix from the jdk11 and 17 tables. We will not be shipping those due to this issue https://bugs.openjdk.org/browse/JDK-8313240
jerboaa
commented
8 months ago I've removed aix from the jdk11 and 17 tables. We will not be shipping those due to this issue https://bugs.openjdk.org/browse/JDK-8313240
Note: The harfbuzz upgrade (JDK-8313643) is in 17.0.11 and 11.0.23 (both April) so those should be shippable by the April 2024 update.
ijuma
commented
8 months ago I think the table headers should say jdk21 below
smlambert
commented
8 months ago 
chadlwilson
commented
8 months ago Hey folks, minor one - are you missing JDK21 aarch64 alpine linux from the table? Was added slightly prior to last release - see https://github.com/adoptium/containers/issues/158#issuecomment-1757915275
It was in the table in #6 for what it’s worth :)
Haroon-Khel
commented
8 months ago Updated, thanks @chadlwilson
ranma2913
commented
8 months ago Good morning.
Is there any update on the x64 alpine-Linux images for 17 & 21? I'm looking forward to the patch of CVE-2022-45146.
Any way I can help?
jerboaa
commented
8 months ago Is there any update on the
x64 alpine-Linuximages for 17 & 21? I'm looking forward to the patch of CVE-2022-45146.
The OpenJDK updates won't fix anything in a third party (bouncycastle crypto provider). You'd have to look at a 1.0.2.4 Bouncycastle release. E.g. https://repo1.maven.org/maven2/org/bouncycastle/bc-fips/1.0.2.4/
kwin
commented
8 months ago Can someone share what is different between https://github.com/adoptium/temurin11-binaries/releases/tag/jdk-11.0.22%2B7 and https://github.com/adoptium/temurin11-binaries/releases/tag/jdk-11.0.22%2B7.1 (the latter being only available for Mac OS)? Unfortunately https://adoptium.net/temurin/release-notes/?version=jdk-11.0.22+7.1 does not load for me....
jerboaa
commented
8 months ago Can someone share what is different between https://github.com/adoptium/temurin11-binaries/releases/tag/jdk-11.0.22%2B7 and https://github.com/adoptium/temurin11-binaries/releases/tag/jdk-11.0.22%2B7.1 (the latter being only available for Mac OS)? Unfortunately https://adoptium.net/temurin/release-notes/?version=jdk-11.0.22+7.1 does not load for me....
Please see the release blog: https://adoptium.net/blog/2024/01/eclipse-temurin-8u402-11022-1710-and-2102-available/
TLDR; Use +7.1 on MacOS and +7 for everything else. Both have all the fixes from the January CPU.
mjuergens-cg
commented
7 months ago Is there any update on the
x64 alpine-Linuximages for 17 & 21? I'm looking forward to the patch of CVE-2022-45146.The OpenJDK updates won't fix anything in a third party (bouncycastle crypto provider). You'd have to look at a 1.0.2.4 Bouncycastle release. E.g. https://repo1.maven.org/maven2/org/bouncycastle/bc-fips/1.0.2.4/
I think this question stems from the fact that Prisma Cloud detects CVE-2022-45146 in the single temurin binary, no matter if an additional bouncycastle dependency is used or not. We suspect that this is a false positive. Could anyone confirm that this is indeed the case, i.e., temurin on its own (without bouncycastle being used) is not affected by CVE-2022-45146?
Thanks!
Sharing information in this issue since the TCK work is being tracked in temurin-compliance private repo not visible to the community (as per the OCTLA). Risks and expectations for timing on the release are listed in this issue comment. Primary platforms (x64 Linux/Windows/OSX and aarch64 Linux/OSX) in bold are prioritized, secondary platforms not in bold follow in no particular order (as machine resources are available). We retrospectively measure and track how well we do against these targets in these Adoptium Release Scorecards in order to continuously assess and improve.
✔️ results in these Tables means the activity has successfully completed.
⏳ results means that we are actively working on closing off the runs needed for this version, platform, binaryType.
⛔ means there is no build planned for that version/platform combination.
⏸️ means activity not yet started.
JDK 8u402-b06
JDK 11.0.22+7
JDK 17.0.10+7
JDK 21.0.2+13