Spectrum again/still shipping with outdate JRE

[Raphael Franck]

Hello Broadcom,

great to see another release of the DX NetOps software suite.
Quickly checking the release notes for Spectrum (System Requirements for Linux), I found the included/required AdoptOpenJDK JRE to be 8u302. That release is from July 2021 (Archive | Adoptium), means approaching an age of 2 years. Shipping old software components like that has been a discussion for years and isn't really acceptable. Please incoporate more recent (up-to-date) JRE versions with the product on a regular basis to avoid potential vulnerability exposure.

thanks,
Raphael

[Jeffrey Pinard]

It appears latest Spectrum 22.2.5 is shipping with AdoptOpenJDK 8u352 (Oct 22, 2022).

And the next available release is 8u362, which just came out Jan 20th, 2022.  That'll probably be looked at for upcoming release.

Docs could probably be updated to reflect when Java is upgraded.

[Raphael Franck]

Hi @Jeffrey Pinard,

thanks for following up and sorry for me not verifying docs vs. reality first.
I've raised a doc update request.

regards,
Raphael​