Language runtime support policy for Azure App Service
This article describes the language runtime support policy for updating existing stacks and retiring end-of-support stacks in Azure App Service. This policy clarifies existing practices and doesn't represent a change to customer commitments.
Updates to existing stacks
App Service updates existing stacks after they become available from each community. App Service updates major versions of stacks but can't guarantee any specific minor versions or patch versions. The platform controls minor and patch versions. For example, App Service updates Node 18 but doesn't guarantee a specific Node 18.x.x version. If you need a specific minor or patch version, use a custom container.
Retirements
App Service follows community support timelines for the lifecycle of the runtime. After community support for a language reaches the end of support, your applications continue to run unchanged. However, App Service can't provide security patches or related customer support for that runtime version past its end-of-support date. If your application has any problems past the end-of-support date for that version, you should move up to a supported version to receive the latest security patches and features.
Important
If you're running apps that use an unsupported language version, you need to upgrade to a supported language version before you can get support for those apps.
Notifications
End-of-support dates for runtime versions are determined independently by their respective stacks and are outside the control of App Service. App Service sends reminder notifications to subscription owners for upcoming end-of-support runtime versions when they become available for each language.
Roles that receive notifications include account administrators, service administrators, and coadministrators. Contributors, readers, or other roles don't directly receive notifications unless they opt in to receive notification emails by using Service Health Alerts.
Timelines for language runtime version support
To learn more about specific timelines for the language support policy, see the following resources:
Support status
App Service supports languages on both Linux and Windows operating systems. See the following resources for the list of OS support for each language:
Configure language versions
To learn more about how to update language versions for your App Service applications, see the following resources:
Java-specific runtime statement of support
JDK versions and maintenance
Microsoft and Adoptium builds of OpenJDK are provided and supported on App Service for Java 21, 17, 11, and 8. These binaries are provided as a no-cost, multiplatform, production-ready distribution of OpenJDK for Azure. The binaries contain all the components for building and running Java SE applications. For local development or testing, you can download the Microsoft build of OpenJDK.
| Java stack name | Linux distribution | Java distribution |
|---|---|---|
| Java 8 | Alpine 3.16* | Adoptium Temurin 8 (MUSL) |
| Java 11 | Alpine 3.16* | MSFT OpenJDK 11 (MUSL) |
| Java 17 | Ubuntu | MSFT OpenJDK 17 |
| Java 21 | Ubuntu | MSFT OpenJDK 21 |
| Tomcat 8.5 Java 8 | Alpine 3.16* | Adoptium Temurin 8 (MUSL) |
| Tomcat 8.5 Java 11 | Alpine 3.16* | MSFT OpenJDK 11 (MUSL) |
| Tomcat 9.0 Java 8 | Alpine 3.16* | Adoptium Temurin 8 (MUSL) |
| Tomcat 9.0 Java 11 | Alpine 3.16* | MSFT OpenJDK 11 (MUSL) |
| Tomcat 9.0 Java 17 | Ubuntu | MSFT OpenJDK 17 |
| Tomcat 9.0 Java 21 | Ubuntu | MSFT OpenJDK 21 |
| Tomcat 10.0 Java 8 | Ubuntu | Adoptium Temurin 8 |
| Tomcat 10.0 Java 11 | Ubuntu | MSFT OpenJDK 11 |
| Tomcat 10.0 Java 17 | Ubuntu | MSFT OpenJDK 17 |
| Tomcat 10.0 Java 21 | Ubuntu | MSFT OpenJDK 21 |
| Tomcat 10.1 Java 11 | Ubuntu | MSFT OpenJDK 11 |
| Tomcat 10.1 Java 17 | Ubuntu | MSFT OpenJDK 17 |
| Tomcat 10.1 Java 21 | Ubuntu | MSFT OpenJDK 21 |
| JBoss 7.3 Java 8 | Ubuntu | Adoptium Temurin 8 |
| JBoss 7.3 Java 11 | Ubuntu | MSFT OpenJDK 11 |
| JBoss 7.4 Java 8 | Ubuntu | Adoptium Temurin 8 |
| JBoss 7.4 Java 11 | Ubuntu | MSFT OpenJDK 11 |
| JBoss 7.4 Java 17 | Ubuntu | MSFT OpenJDK 17 |
* Alpine 3.16 is the last supported Alpine distribution in App Service. You should pin to a version to avoid switching over to Ubuntu automatically. Make sure that you test and switch to a Java offering that is supported by Ubuntu-based distributions when possible.
If you're pinned to an earlier minor version of Java, your app might be using the deprecated Azul Zulu for Azure binaries that are provided through Azul Systems. You can keep using these binaries for your app, but any security patches or improvements are available only in more recent versions of OpenJDK. In this scenario, we recommend that you periodically update your web apps to a more recent version of Java.
Major version updates are provided through new runtime options in Azure App Service. Update to these later versions of Java by configuring your App Service deployment. You're responsible for testing and ensuring the major update meets your needs.
Supported JDKs are automatically patched on a quarterly basis in January, April, July, and October of each year. For more information, see Java on Azure.
Security updates
Patches and fixes for major security vulnerabilities are released as soon as they become available in Microsoft builds of OpenJDK. A major vulnerability is a vulnerability that has a base score of 9.0 or higher on the NIST Common Vulnerability Scoring System, version 2.
Tomcat 8.5 reached end of support as of March 31, 2024 and Tomcat 10.0 reached end of support as of October 31, 2022.
Although the runtimes are still available on Azure App Service, Tomcat 10 and Tomcat 8.5 don't receive security updates.
When possible, migrate your applications to Tomcat 9.0 or Tomcat 10.1. Tomcat 9.0 and Tomcat 10.1 are available on Azure App Service. For more information, see the Apache Tomcat documentation.
Community support for Java 7 ended on July 29, 2022 and Java 7 was retired from App Service. If you have a web app running on Java 7, upgrade to Java 8 or Java 11 immediately.
Deprecation and retirement
If a supported Java runtime is retired, Azure developers who use the affected runtime receive a deprecation notice at least six months before the runtime is retired.
Local development
Developers can download the Microsoft build of OpenJDK for local development.
Product support for the Microsoft build of OpenJDK is available through Microsoft when you develop for Azure or Azure Stack with a qualified Azure support plan.