Hacker News Reader

Well, perhaps they should upgrade it for the sake of the ~170 CVEs that have been published against Java 1.8.0_60? https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

Sure, a lot of those probably don't apply to how they're using Java, but I'd bet at least a couple do.

Vendors often backport CVEs without changing version numbers.

Or review the details and decide that the specific issue doesn't apply to them. This actually makes sense in larger environments.

They're missing out on probably dozens of security fixes from the past 4 years. Unless they depend on buggy behavior, it is incredibly unlikely that they'll have any backwards compatibility issues, and hopefully they would have tests they could run against a newer JVM to help surface those issues.

> changes should be approached with extreme caution.

It's good to make updates carefully, with full testing and a rollback plan. It is also important to actually push updates.