← /writing
Migrations

Cascading dep hell: Java 8 → 17 across 35 services

End-of-support runtimes don't just block CVE fixes — they block every transitive update that depends on them. A field report from a 35-service upgrade.

Navneet Lal Gupta

2026-04-10 · 6 min read

// notes

Java 8 → 17

35 services · 100+ CVEs closed

Stub. Full post body to follow.

The runtime upgrade itself was the easy part. The hard part was every transitive dependency that hadn’t shipped a Java-17-compatible release while the org was sitting on Java 8 — and the cascading chain of updates that triggered.

// RELATED