Legacy Java Application Support

Java 8 was released in 2014 and is still the most widely deployed Java version. Oracle changed the licensing model: post-2019 Java 8 updates from Oracle require a commercial licence. Many businesses are stuck on the last free Java 8 update or have unknowingly lapsed their licence.

Java 17 (LTS, released 2021) and Java 21 (LTS, released 2023) are the current long-term support versions. The upgrade path involves handling removed APIs (Nashorn JavaScript engine, Java EE modules), updating dependencies, and resolving breaking changes in newer JDKs.

We also sort out the JDK distribution question. Oracle JDK, Eclipse Temurin (AdoptOpenJDK), Amazon Corretto, Azul Zulu. Which one? For most businesses, Temurin or Corretto are the right choice. Free, well-supported, and production-ready.

Spring Framework 4.x and 5.x to Spring Framework 6 / Spring Boot 3. The big jump: Spring 6 / Spring Boot 3 requires Java 17+ and Jakarta EE (javax → jakarta namespace change). This namespace migration affects every import statement using javax.servlet, javax.persistence, javax.validation.

Spring MVC → Spring Boot migration for applications that never adopted Boot. Older Spring applications using XML configuration migrated to Java configuration and annotations. Spring Security configuration updates (the security configuration DSL has changed significantly).

EJB → Spring migration for J2EE applications. Enterprise JavaBeans replaced with Spring dependency injection, Spring Data JPA, and Spring Security. Session beans, message-driven beans, and entity beans replaced with modern Spring equivalents.

Java applications with security vulnerabilities. Log4j (CVE-2021-44228) was the headline, but there are many more: outdated libraries in the classpath, insecure deserialization, XML entity injection, and JDBC injection.

We run dependency analysis (OWASP Dependency-Check, Snyk), review authentication and authorisation logic, check for common Java vulnerabilities, and fix everything. Maven/Gradle dependencies updated to patched versions.

For applications on end-of-life Java versions (Java 6, 7, and Oracle Java 8 without a support contract), the most important security fix is the JDK upgrade itself. Old JDKs have known vulnerabilities that will not be patched.

Monthly support plans for legacy Java applications. Bug fixes, security monitoring, dependency management, performance investigations, and small feature requests. A developer who knows your codebase.

Many legacy Java applications run critical business processes but nobody in the organisation understands the code. The original developer left years ago. The application works, but nobody dares touch it.

We take over legacy Java codebases. Audit the application, document the architecture, set up CI/CD (Jenkins, GitHub Actions, or GitLab CI), and resume maintenance. We work with Maven, Gradle, Ant, or whatever build system the project uses.

Legacy Java applications running on WebSphere, WebLogic, JBoss/WildFly, or GlassFish. These heavyweight application servers are expensive (licensing), complex (configuration), and increasingly unnecessary.

Modern Java applications run on embedded servers: Spring Boot with embedded Tomcat, Jetty, or Undertow. The application is a single JAR file that starts with `java -jar`. No application server installation, no EAR/WAR deployment, no JNDI configuration.

The migration involves extracting the application from the app server's proprietary features (WebSphere's Java EE extensions, WebLogic clustering, JBoss-specific annotations) and replacing them with Spring Boot equivalents or standard Java.