JDK-8191138 : Remove deprecated java.security.acl APIs
  • Type: Enhancement
  • Component: security-libs
  • Sub-Component: java.security
  • Affected Version: 14
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • Submitted: 2017-11-13
  • Updated: 2020-03-20
  • Resolved: 2019-07-30
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 14
14 b08Fixed
Related Reports
Blocks :  
CSR :  
Relates :  
Relates :  
Sub Tasks
JDK-8228664 :  
The deprecated java.security.acl APIs were marked with forRemoval=true in JDK 10 and thus should be removed.
For WildFly dependencies, see also https://jira.jboss.org/browse/WFCORE-4282

URL: https://hg.openjdk.java.net/jdk/jdk/rev/11de092bcc5a User: mullan Date: 2019-07-30 13:27:38 +0000

Related bugs/issues from external projects removing dependencies: Oak: https://jira.apache.org/jira/browse/OAK-7024 (closed) https://jira.apache.org/jira/browse/OAK-7358 (open) Jetty: https://github.com/eclipse/jetty.project/issues/3394 (closed) WildFly: https://issues.jboss.org/browse/ELY-1744 (open)

Re-targeting to 14. Also want to double-check a few projects that may still be using these APIs to make sure they have a plan in place to migrate away from these APIs if necessary.

Apache CXF also has dependencies on java.security.acl. See https://issues.apache.org/jira/browse/CXF-7815 (which has been resolved).

Re-targeting the removal to JDK 13. Although I believe usage of these APIs should be very rare, I would like to give the community more time to prepare for the removal, given that these were initially deprecated in JDK 9 and marked for removal in JDK 10. With the 6 month release cadence, the extra time will give us a higher level of confidence, especially as more developers and projects upgrade to JDK 11.

Re-targeting the removal of these APIs from JDK 11 to JDK 12. These APIs were initially deprecated in JDK 9 and marked for removal in JDK 10. Given the new 6 month release cadence, it may be too aggressive to deprecate and remove an API in 1 year. See also https://issues.apache.org/jira/browse/OAK-7024 for more info/progress on one project that is impacted by this removal.