Language runtime support policy for App Service
This article describes the language runtime support policy for updating existing stacks and retiring end-of-support stacks in Azure App Service. This policy clarifies existing practices and doesn't represent a change to customer commitments.
Updates to existing stacks
App Service updates existing stacks after they become available from each community. App Service updates major versions of stacks but can't guarantee any specific minor or patch versions. The platform controls minor and patch versions. For example, App Service updates Node 18 but doesn't guarantee a specific Node 18.x.x version. If you need a specific minor or patch version, you can use a custom container.
Retirements
App Service follows community support timelines for the lifecycle of the runtime. After community support for a language reaches the end of support, your applications continue to run unchanged. However, App Service can't provide security patches or related customer support for that runtime version past its end-of-support date. If your application has any problems past the end-of-support date for that version, you should move up to a supported version to receive the latest security patches and features.
Important
If you're running apps that use an unsupported language version, you need to upgrade to a supported language version before you can get support for those apps.
Notifications
End-of-support dates for runtime versions are determined independently by their respective stacks and are outside the control of App Service. App Service sends reminder notifications to subscription owners for upcoming end-of-support runtime versions when they become available for each language.
Roles that receive notifications include account administrators, service administrators, and coadministrators. Contributors, readers, or other roles don't directly receive notifications unless they opt in to receive notification emails, using Service Health Alerts.
Timelines for language runtime version support
To learn more about specific timelines for the language support policy, see the following resources:
Support status
App Service supports languages on both Linux and Windows operating systems. See the following resources for the list of OS support for each language:
Configure language versions
To learn more about how to update language versions for your App Service applications, see the following resources:
Java-specific runtime statement of support
JDK versions and maintenance
Microsoft and Adoptium builds of OpenJDK are provided and supported on App Service for Java 8, 11, 17, and 21. These binaries are provided as a no-cost, multi-platform, production-ready distribution of the OpenJDK for Azure. They contain all the components for building and running Java SE applications. For local development or testing, you can install the Microsoft build of OpenJDK from the downloads page.
| Java stack name | Linux distribution | Java distribution |
|---|---|---|
| Java 8 | Alpine 3.16* | Adoptium Temurin 8 (MUSL) |
| Java 11 | Alpine 3.16* | MSFT OpenJDK 11 (MUSL) |
| Java 17 | Ubuntu | MSFT OpenJDK 17 |
| Java 21 | Ubuntu | MSFT OpenJDK 21 |
| Tomcat 8.5 Java 8 | Alpine 3.16* | Adoptium Temurin 8 (MUSL) |
| Tomcat 8.5 Java 11 | Alpine 3.16* | MSFT OpenJDK 11 (MUSL) |
| Tomcat 9.0 Java 8 | Alpine 3.16* | Adoptium Temurin 8 (MUSL) |
| Tomcat 9.0 Java 11 | Alpine 3.16* | MSFT OpenJDK 11 (MUSL) |
| Tomcat 9.0 Java 17 | Ubuntu | MSFT OpenJDK 17 |
| Tomcat 9.0 Java 21 | Ubuntu | MSFT OpenJDK 21 |
| Tomcat 10.0 Java 8 | Ubuntu | Adoptium Temurin 8 |
| Tomcat 10.0 Java 11 | Ubuntu | MSFT OpenJDK 11 |
| Tomcat 10.0 Java 17 | Ubuntu | MSFT OpenJDK 17 |
| Tomcat 10.0 Java 21 | Ubuntu | MSFT OpenJDK 21 |
| Tomcat 10.1 Java 11 | Ubuntu | MSFT OpenJDK 11 |
| Tomcat 10.1 Java 17 | Ubuntu | MSFT OpenJDK 17 |
| Tomcat 10.1 Java 21 | Ubuntu | MSFT OpenJDK 21 |
| JBoss 7.3 Java 8 | Ubuntu | Adoptium Temurin 8 |
| JBoss 7.3 Java 11 | Ubuntu | MSFT OpenJDK 11 |
| JBoss 7.4 Java 8 | Ubuntu | Adoptium Temurin 8 |
| JBoss 7.4 Java 11 | Ubuntu | MSFT OpenJDK 11 |
| JBoss 7.4 Java 17 | Ubuntu | MSFT OpenJDK 17 |
* Alpine 3.16 is the last supported Alpine distribution in App Service. You should pin to a version to avoid switching over to Ubuntu automatically. Make sure you test and switch to Java offering supported by Ubuntu based distributions when possible.
If you're pinned to an older minor version of Java, your app might be using the deprecated Azul Zulu for Azure binaries provided through Azul Systems. You can keep using these binaries for your app, but any security patches or improvements are available only in new versions of the OpenJDK, so we recommend that you periodically update your Web Apps to a later version of Java.
Major version updates are provided through new runtime options in Azure App Service. Customers update to these newer versions of Java by configuring their App Service deployment and are responsible for testing and ensuring the major update meets their needs.
Supported JDKs are automatically patched on a quarterly basis in January, April, July, and October of each year. For more information on Java on Azure, see this support document.
Security updates
Patches and fixes for major security vulnerabilities are released as soon as they become available in Microsoft builds of the OpenJDK. A "major" vulnerability has a base score of 9.0 or higher on the NIST Common Vulnerability Scoring System, version 2.
Tomcat 8.5 reached End of Life as of March 31, 2024 and Tomcat 10.0 reached End of Life as of October 31, 2022.
While the runtimes are still available on Azure App Service, Tomcat 8.5 or 10.0 won't receive security updates.
When possible, migrate your applications to Tomcat 9.0 or Tomcat 10.1. Tomcat 9.0 and Tomcat 10.1 are available on Azure App Service. For more information, see the official Tomcat site.
Community support for Java 7 ended on July 29, 2022 and Java 7 was retired from App Service. If you have a web app running on Java 7, upgrade to Java 8 or 11 immediately.
Deprecation and retirement
If a supported Java runtime is retired, Azure developers using the affected runtime receive a deprecation notice at least six months before the runtime is retired.
Local development
Developers can download the Microsoft Build of OpenJDK for local development from our download site.
Product support for the Microsoft Build of OpenJDK is available through Microsoft when developing for Azure or Azure Stack with a qualified Azure support plan.