no valid dependencies for jdk, 14.* 😭 about bellsoft-liberica

[nebhale]

The buildpacks, going back to the inception of Cloud Foundry, have a policy of not shipping unsupportable versions of dependencies. In this case, the OpenJDK community describes the support windows of releases, and they’re quite clear that for non LTS versions, a version becomes unsupported (as in we can no longer upstream fixes for CVEs) one month after the release of the next version. To facilitate this, the .0 release of a version comes out “off-cycle” a month earlier than the quarterly release schedule would dictate

In the case of the 14 to 15 transition, the buildpack starting shipping both Java 14 and 15 with 4.0.0 on September 23rd. With the release of 15.0.1 (along with Java 8 and 11 releases) we removed 14 in 5.0.0 on October 22. This means that for four weeks we shipped both 14 and 15 giving the OpenJDK-designed window for migration.

This rapid and mandatory upgrade cycle is why both we and the OpenJDK maintainers recommend against going to production on non-LTS versions and instead only using them for testing.

[benleb]

perfect explanation, sounds reasonable, thanks!