We’re excited to announce the general availability of the Oracle Cloud Infrastructure (OCI) software developer kit (SDK) v3 or 3.0.0 for Java. OCI SDK v3 for Java adds several features, including important security updates. We have drastically reduced the number of third-party libraries in the SDK v3 for Java by relying more on features already built into Oracle Java, making it our most secure OCI Java SDK yet.
We’re also delighted to announce support for the Micronaut framework in OCI SDK v3 for Java. With a combination of Micronaut 3.7, OCI SDK v3 for Java, and GraalVM native image, developers can build fast and efficient ahead-of-time compiled OCI cloud native microservices that are easy to containerize.
OCI SDK v3 for Java includes frequently requested features, such as pluggable HTTP client layers, simplified client configuration, and a reduction in the number of dependencies on third-party libraries. By reducing third-party dependencies and leaning more on code already present in the Java Development Kit (JDK), fewer cases of security vulnerabilities caused by third-party package issues can arise.
We have greatly improved the user experience with smaller package sizes and a reduced chance of conflicts with third-party dependencies in your projects. With OCI SDK v3 for Java, the size of the OCI Java SDK has decreased from 101 MB to 85 MB, a reduction of 15%. Third-party dependencies’ size has decreased by 17% from 18 MB to 15 MB, while the number of dependencies has decreased from 43 down to 37, a 14% reduction.
Like other OCI SDKs, SDK v3 for Java is available on GitHub and supports all OCI services. With the weekly release of the new v3 SDK for Java, we want to reassure you that we continue to support the v2 version of the SDK on a weekly basis with all new services or features and bug or security fixes for a period of six months until June 13, 2023. For more information, on our support model for the v2 version of the OCI SDK for Java, refer to the end of this blog. We have also released a guide on Updates in the OCI SDK for Java 3 that outlines the list of changes you need to make to migrate to OCI SDK v3 for Java.
We have made HTTP client libraries easy to plug in and use OCI SDK for Java. Today, OCI SDK v3 for Java offers the following choices for HTTP client libraries:
Jakarta EE 8/Jersey 2: bmc-common-httpclient-jersey
Jakarta EE 9/Jersey 3: bmc-common-httpclient-jersey3
HTTP transport pluggability lays the groundwork necessary to change the default HTTP client library to another provider, such as Netty, in a future release. However, OCI SDK v3 for Java with Netty is already available today when using the Micronaut framework. See this Micronaut example with Netty using Object Storage and Autonomous Database.
We have removed the Guava and Apache Commons third-party libraries from the Java SDK and replaced them with classes already in the JDK provided by Oracle. As a result of this change, fewer cases of security vulnerabilities caused by third-party package issues can arise and give lesser need for you to upgrade SDK for Java version to mitigate such security vulnerabilities in third-party packages.
The following third-party dependency jars have been removed from the Java SDK:
We plan to remove more third-party dependencies from the Java SDK as we roll out newer versions.
You can set many standard client configuration properties uniformly, regardless of the chosen HTTP client library, including the following examples:
Read and connect timeout
Asynchronous thread pool size
Whether to buffer requests
Key store and trust store
The v3 SDK for Java is a major upgrade of v2. So, migration from v2 to v3 might require some code changes on your part. However, we’re aware that you might continue to use v2 SDK for Java before starting your migration to v3. While the new v3 SDK for Java ships weekly, we still support the v2 version of the SDK for Java for a period of six months until June 13, 2023. During this six-month period, the v2 version is supported on a weekly basis with all the new services or features and bug or security fixes so that you have sufficient time to upgrade to v3. After June 13, 2023, we recommend using OCI SDK v3 for Java to avail yourself of the new services and latest features with bug and security fixes.
After June 13, 2023, you can continue to use SDK v2 for Java. But OCI doesn’t release weekly updates of new services or the latest features or bug fixes. So, after June 13, 2023, for a duration of 12 months, OCI v2 SDK for Java enters maintenance mode, meaning that OCI limits v2 SDK for Java to address critical bugs and security vulnerability fixes only.
Our source code on GitHub
We encourage you to provide feedback to us by opening a GitHub issue. Issues you open are addressed by our team. Providing feedback using GitHub issues also helps other users to engage in the conversation or find solutions to their issues.
If you need help, you can use the following channels:
Kartik is a Senior Product Manager with OCI Developer Experience team.