Oracle has redoubled its efforts to address the recent spate of vulnerabilities related to Java running in web browsers, but the renewed focus on security has had an unfortunate side effect – namely, that Java 8 will no longer ship by its planned September 2013 release date.
According to Mark Reinhold, chief architect for Oracle's Java platform group, the database giant's recent efforts to patch highly publicized security holes in the Java plug-in have sapped the resources of the ongoing Java 8 development effort.
"Maintaining the security of the Java Platform always takes priority over developing new features, and so these efforts have inevitably taken engineers away from working on Java 8," Reinhold wrote in a blog post on Thursday.
As a result, he said, delivering all of the features currently slated for Java 8 by early September, as previously planned, is "no longer achievable."
As Reinhold detailed in his post, one possible solution for Java 8's schedule slippage might have been to drop some proposed features from the release. Oracle has actually opted for this approach before; in July 2012, it deferred Project Jigsaw, a planned feature that would allow developers to write and distribute Java code as modules, until 2015.
But as Reinhold noted, nixing Jigsaw left Project Lambda, an effort to add Lisp-like code structures to the Java syntax, as pretty much the only significant new feature to be delivered in Java 8.
"If we drop Lambda then the remaining features are interesting but not, taken as a whole, very compelling," Reinhold wrote. "A Lambda-less release this year would hence be unlikely to gain wide adoption, so why bother?"
Another option might have been to rush the Java 8 development effort by shortening the time allotted for community feedback and testing. But Reinhold sees that approach as being even less palatable than delaying Lambda until the next Java release.
"If we sacrifice quality in order to maintain the schedule then we'll almost certainly repeat the well-worn mistakes of the past," he wrote, "carving incomplete language changes and API designs into virtual stone where millions of developers will have to work around their flaws for years to come until those features – or the entire Platform – are replaced by something new."
Instead, Reinhold wrote, the "least-bad" solution is to delay Java 8 again. Yes, again – Oracle originally planned to ship it in late 2012, but those plans were put on hold when the Java 7 development effort met with similar delays.
Under the new plan – assuming the rest of the Java development community accepts Reinhold's proposal – Java 8 will be declared feature-complete next month and will enter beta testing in September, with a final release scheduled for mid-March 2014.
"If we adopt my proposal ... then we should be able to complete the browser-related security work to which we've committed and then resume a regular two-year release cadence," Reinhold wrote, "with Java 8 due in early 2014 and Java 9 in early 2016." ®