Yes, Java 17 still receives updates, but the answer depends on the build. A third party tracker lists Oracle JDK premier support for 17 as ending on 30 September 2026, with extended support to 30 September 2029. Adoptium lists Temurin 17 as available at least until October 2027.
What changed on 30 September 2026
For Oracle JDK, the end of premier support is a commercial milestone. It moves Java 17 into extended support, which in Oracle's model is a separate arrangement. If you run Oracle JDK without that arrangement, you should confirm what updates you are entitled to. I could not fetch Oracle's own roadmap page (it returned an access error), so use that page as the final word.
If you run a free community build, the relevant commitment comes from that project. Adoptium's page lists Java 17 as "at least Oct 2027."
Three situations
| You run | What to check | Likely action |
|---|---|---|
| Free community build (for example Temurin) | Vendor end date, October 2027 at least | Plan a move to 21 or 25 within a year |
| Oracle JDK under a paid arrangement | Terms for extended support | Move on your own schedule, keep patching |
| Oracle JDK with no arrangement | Entitlement to updates | Switch builds or upgrade first |
This is not legal advice. Licence terms differ by version and use, so read yours.
The cost of waiting
Java 17 is the release that strongly encapsulated JDK internals (JEP 403). Code that broke on that change has usually been fixed by now. The next jump, to 21 or 25, tends to be smaller than the one from 8 or 11 to 17. Teams that wait until the last supported quarter tend to combine the upgrade with other deadlines, and that is when it gets rushed.
A short plan
- Confirm your vendor and the end date for your exact build.
- Choose 21 or 25 as the target. Java 25 is the newest LTS in the Adoptium list.
- Run the test suite on the target and read warnings. Deprecation notices on 17 often become removals later.
- Update the build image, CI and run scripts together.
- Keep the quarterly patch rhythm after the move. OpenJDK ships security updates every three months.
Try it yourself
The fix available now demo shows a vulnerable component with an available upgrade. A runtime that is behind on quarterly patches looks the same: the fix exists and the work is applying it.
Click through it at your own pace, or open it full screen.
Safeguard can scan for dependency and container findings and open fix pull requests, which are off by default and need your approval. The free scan is at gold.safeguard.sh/scan.
Quick check
Does Java 17 get security patches today?
Yes. The trackers show recent 17.0.x builds dated August 2026. Whether you receive them depends on your vendor and terms.
Should I go to 21 or 25?
Both are LTS. Java 25 has the later end dates in both sources, but choose the one your frameworks and vendor support and test on.
For a full comparison, see How long is each Java LTS version supported.
Sources
- endoflife.date Oracle JDK data
- Adoptium supported platforms and release support
- JEP 403: Strongly Encapsulate JDK Internals
Last reviewed: 19 October 2026.
