OpenJDK Update (January 2024 Patch releases)

[reta]

Is your feature request related to a problem? Please describe

OpenJDK JDK 21.0.2 [1], 17.0.10, 11.0.22, and 8u401 have been released [3]

[1] https://mail.openjdk.org/pipermail/jdk-updates-dev/2024-January/029090.html
[2] https://mail.openjdk.org/pipermail/jdk-updates-dev/2024-January/029089.html
[3] https://blogs.oracle.com/java/post/jdk-2102-17010-11022-and-8u401-have-been-released

Describe the solution you'd like

Update JDKs across all maintenance branches.

Related component

Build
Documentation: opensearch-project/documentation-website#6246

Describe alternatives you've considered

N/A

Additional context

Possible update blockers:

• https://bugs.openjdk.org/browse/JDK-8323659

[peternied]

[Triage - attendees 1 2 3]
Thanks for filing, lets make sure to take these update to get CVE fixes from the JDK

[kiranprakash154]

Hi, are we on track for this to be released in 2.12 ?

[reta]

Hi, are we on track for this to be released in 2.12 ?

@kiranprakash154 I am not sure yet, watching [1], [2] few platforms are still not available.

[1] https://adoptium.net/temurin/releases/
[2] adoptium/temurin#17

[bbarani]

I see a new version (jdk-21.0.2+13) released yesterday https://github.com/adoptium/temurin21-binaries/releases CC @reta

[reta]

@bbarani I know, we need more platforms, please check adoptium/temurin#17

[msfroh]

I see a new version (jdk-21.0.2+13) released yesterday https://github.com/adoptium/temurin21-binaries/releases CC @reta

Would we want to pick up 21.0.2+13 if it has https://bugs.openjdk.org/browse/JDK-8323659 ? (The ExecutorScalingQueue class in that code snippet is still in use in OpenSearch.)

[reta]

Would we want to pick up 21.0.2+13 if it has https://bugs.openjdk.org/browse/JDK-8323659 ? (The ExecutorScalingQueue class in that code snippet is still in use in OpenSearch.)

We'll double check, we use LinkedTransferQueue (the description has it as the context item)

[reta]

A quick update, the regression in JDK-21.0.2 (https://bugs.openjdk.org/browse/JDK-8323659) seems to be reported by Elasticsearch folks and directly applies (and impacts) to OpenSearch (we've largely the same codebase), we either ether have to:

• come up with workaround (probably best option, since there are security fixes there)
• ban 21.0.2 (worst case)

[dbwiddis]

Option 3 is to try to encourage the JDK folks to release 21.0.2.1.

I see you've already got a PR for the first option.

[reta]

Option 3 is to try to encourage the JDK folks to release 21.0.2.1.

Thanks @dbwiddis , I think this is off the table right now - I've gone through mailing list and apparently this bug alone does not warrant the patch release (at least, this is what I have understood).