Moving from CE 7.4.3.125 (Java 8) to DXP: security fixes, Java support and upgrade path

General
1

Hi everyone,

We run Liferay Portal CE 7.4.3.125 (GA125) on Java 8 in production for our customers. We are evaluating our options (staying on CE or moving to DXP) and would appreciate guidance from the community or Liferay staff. A migration of our product to Java 21 is planned for mid 2027.

Context: the latest CE release we can find is GA132 (February 2025), and NVD lists 40 CVEs still affecting it. For almost all of them, the Liferay advisory says “fixed on master branch”, so there is no ready-to-install CE release containing the fix. For us, a security fix must be validated by Liferay, so we do not want to patch CE ourselves.

Questions:

  1. Java 8 and DXP: the compatibility matrix says Java 8 runtime is certified up to DXP 2024.Q1 (LTS) and removed from 2024.Q2. Do the latest 2024.Q1.x update levels still run on Java 8, and do they still receive security fixes under a subscription?

  2. 2025 CVEs: are the CVEs published in 2025 (for example CVE-2025-43773, CVE-2025-43745, CVE-2025-4581) fixed in a DXP release that is still certified on Java 8, or only in more recent releases?

  3. Upgrade path: what is the supported path from Liferay Portal CE 7.4.3.125 to DXP (2024.Q1 LTS or 2025.Q1 LTS)? Which tool is used, and what are the typical constraints?

  4. Java and namespace: the matrix lists Tomcat 9 with Java 17/21 for DXP 7.4 through 2025.Q1. Can we assume these releases still use the javax.* namespace, and from which release is jakarta.* mandatory? What is the support end date for the 2025.Q1 LTS?

  5. Community Edition: the April 2025 “Community Edition Release Strategy” post says CE follows an annual release aligned with the LTS. When is the next CE release expected, the one that will include the security fixes currently only on master? Which Java version(s) will it support (17 and/or 21), and will it use jakarta.*?

Any pointer to the official documentation is welcome. We know that binding answers on pricing, SLA and support end dates must come from Liferay sales and support, and we will contact them separately.

Thank you!