Any plans to upgrade Xnat to work Jre 11+

[Naveen k]

Hi Xnat Team,

I'm wondering if there's any plans to upgrade Xnat to work with Jre 11+ in coming days (Future plans/roadmap)

Regards,

Naveen

[Rick Herrick]

Yes, we’ve been working on upgrading XNAT’s supporting frameworks and code to work with modern Java versions and the latest Tomcat. There’s no release schedule for this at the moment, however.

 

From: xnat_di...@googlegroups.com <xnat_di...@googlegroups.com> on behalf of Naveen k <karduri...@gmail.com>
Date: Thursday, February 29, 2024 at 9:21 AM
To: xnat_discussion <xnat_di...@googlegroups.com>
Subject: External: [XNAT Discussion] Any plans to upgrade Xnat to work Jre 11+

You don't often get email from karduri...@gmail.com. Learn why this is important

--
You received this message because you are subscribed to the Google Groups "xnat_discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to xnat_discussi...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/xnat_discussion/b5f23808-c5cc-4e87-a908-d77965910cdan%40googlegroups.com.

[Naveen k]

Thank you, Rick.  Can we expect this sometime in next year/2026?

Regards,

Naveen Karduri

M.Sc in Software Systems

University of British Columbia.

To view this discussion on the web visit https://groups.google.com/d/msgid/xnat_discussion/MN2PR13MB385364F1E6D90DDBD31B99A2AD5F2%40MN2PR13MB3853.namprd13.prod.outlook.com.

[Naveen k]

Hi Rick,

Just checking to see if there's any progress on upgrading the app framework to the latest Java version.

Thank you,

Naveen

[Timothy Olsen]

Yes.  I'm excited to say we have someone on our team working on it now.  Initially we were looking at a deeper upgrade which would have moved us to Tomcat 10 or 11.  But, it looks like Tomcat 9 is still supported for a while and just upgrading java for that is an easier first step.  So, that is our current target.  We are going to see how that goes and then assess if we should just release that or go for a deeper upgrade for the newer Tomcat versions more urgently.  I'm personally highly motivated to get the easiest fix out ASAP.  Then we can come back and do something more thorough.  But, we'll see how it goes.

Keep an eye out for more updates on XNAT development to this board over the next few weeks.  Lots of changes have happened lately and 2025 is going to be a great year for XNAT.
Tim

[Naveen k]

thank you, Tim. I hope it will out in first quarter of 2025.  Our IT security Team is more concern on having/running with the old version of Java on servers.

[Yuriy Tumanian]

Despite updating to latest xnat-desktop-client version 3.2.5 (3.2.5.938) on mac os sequoia 15.3.1, the app still seems to have a vulnerable java component. Our vulnerability assesment tool (rapid 7 insight vm) seems to be flagging the bundled rt.jar file. Just wanted to confirm that there is indeed a plan to bundle in jre 11 on a future xnat build, regardless of when that may be. Thanks,

Azul Zulu: CVE-2023-41074: Vulnerability in the JavaFX component
Vulnerable software installed: Azul Systems JRE 1.8.0.345
Upgrade Azul Zulu to the latest version
https://www.rapid7.com/db/vulnerabilities/azul-zulu-cve-2023-41074/

(/Applications/XNAT-Desktop-Client.app/Contents/Resources/jre/lib/rt.jar)

[Rick Herrick]

Hey Yuri, sorry we missed this post earlier.

The desktop client is completely separate from XNAT itself. That said, we are currently running into issues getting the desktop client to work on Macs running on Apple Silicon (M1/M2/M3/M4). When we figure out what's going on with that, we'll probably also look into upgrading the version of Java being used internally. The Java functionality in the desktop client is much less complicated than XNAT itself, so the upgrade process shouldn't be as difficult to validate. No guarantees, but hopefully we'll have an update sometime soon.

To view this discussion visit https://groups.google.com/d/msgid/xnat_discussion/d7dc2c37-8792-4e8f-a49b-79c8de2bf902n%40googlegroups.com.