Java 17 EOL Question

[js3344]

Jenkins setup:

• Jenkins controller version 2.440.2, using Java 17.
• Deployed as a Docker Swarm service in AWS, with the controller running on a very large EC2 instance.
• K8s plugin to spin up ephemeral agents in AWS EKS.

Question:

We have had quite a few issues with Jenkins over the past year and a half, although admittedly, most of the issues stem from a lack of knowledge, time and resources around the administration of the platform. My question is around this notification - You are running Jenkins on Java 17, support for which will end on or after Mar 31, 2026. Refer to the documentation for more details.

For practical reasons, we would like to hold off on updating the agents and controllers, as it is a significant lift that poses a threat to business critical processes. I understand and have looked at the documentation, but I’m still a bit unclear as to what happens on April 1st. Will my Jenkins controller (and agents, I suppose) still continue to function?

Secondary Question:

Are there any kind of consulting firms that specialize in tasks like this we could engage for assistance with this task? We would like to get everything updated, as there are some security vulnerabilities we would like to patch.

Thank you!

[MarkEWaite (Mark Waite)]

@js3344

For practical reasons, we would like to hold off on updating the agents and controllers, as it is a significant lift that poses a threat to business critical processes.

You’ve reviewed the security advisories that apply to Jenkins 2.440.2 and have decided that those security advisories are less of a threat to your business critical processes than a Jenkins upgrade? Those advisories include:

• Jenkins Security Advisory 2026-02-18
• Jenkins Security Advisory 2025-12-10
• Jenkins Security Advisory 2025-09-17
• Jenkins Security Advisory 2025-04-02
• Jenkins Security Advisory 2025-03-05
• Jenkins Security Advisory 2024-11-27
• Jenkins Security Advisory 2024-10-02
• Jenkins Security Advisory 2024-08-07
• Jenkins Security Advisory 2024-04-17

That surprises me. You may want to review those advisories more carefully with your risk management team so that they clearly understand the risk that they are accepting by remaining on Jenkins 2.440.2.

@js3344

I understand and have looked at the documentation, but I’m still a bit unclear as to what happens on April 1st. Will my Jenkins controller (and agents, I suppose) still continue to function?

Yes, they will continue to function.

The Jenkins project will not release any new Jenkins controller versions that support Java 17 after March 31, 2026, but existing controllers will continue to run.

@js3344

Are there any kind of consulting firms that specialize in tasks like this we could engage for assistance with this task?

I’m sure that there are such consulting firms, but I’m not aware of any specific firms to recommend. A web search is probably your best choice to find consultants that are in your time zone and understand your business.

[js3344]

Thanks for the information, Mark.

[Colin2 (Colin)]

@js3344

Are there any kind of consulting firms that specialize in tasks like this we could engage for assistance with this task? We would like to get everything updated, as there are some security vulnerabilities we would like to patch.

Hi,

I have helped a few clients through similar Jenkins upgrades - Docker Swarm on EC2 with EKS agents is a setup I know well.

The Java 17 to 21 migration is pretty manageable when you stage it properly, and those security patches do not have to be a massive lift.

Happy to chat if you want to talk through the approach or need an extra set of hands on it.

You can reach out to me on my email here

Colin