Are JDK versions released by pair? [duplicate]

Question

I have JDK 8u60 installed. I checked the Oracle website today and they have released two versions simultaneously: 8u65 and 8u66. Both are public release versions.

• Why did they release two versions simultaneously?
• What conditions/reasons would make one choose one over the other?

Answer 1

From the download page (emphasis added):

Java SE 8u65 includes important security fixes. Oracle strongly recommends that all Java SE 8 users upgrade to this release. Java SE 8u66 is a patch-set update, including all of 8u65 plus additional features (described in the release notes).

Oracle often does this. It's all about how you as a customer want to handle the risks.

Users should only use the corresponding PSU release if they are being impacted by one of the additional bugs fixed in that version as noted in the release notes.

8u65 has security fixes and sets a new security "baseline" for companies to achieve Java 8 applications. 8u66 has those same security updates, plus additional bug fixes. However, even bug fixes can sometimes cause changes to behaviour that present compatibility issues for users. Thus the changes in 8u66 are optional (note that the baseline linked above is still 1.8.0_65, and companies that want more stability in their platform might well prefer to only apply the security fixes, which are necessary.

Oracle is certainly not obligated to split their updates in this fashion, but I'm sure some of their most risk-averse customers are glad to have the option.

Answer 2

This is the official Oracle's answer:

Java CPU and PSU Releases Explained

Starting with the release of Java SE 7 Update 71 (Java SE 7u71) in October 2014, Oracle will release a Critical Patch Update (CPU) at the same time as a corresponding Patch Set Update (PSU) for Java SE 7.

---

Which Java version should I choose: the CPU or the PSU?

Oracle strongly recommends that all Java SE users upgrade to the latest CPU release available for a release family. Most users should choose the CPU release.

Users should only use the corresponding PSU release if they are being impacted by one of the additional bugs fixed in that version as noted in the release notes.

The subsequent CPU release will contain all of the fixes from the current PSU. For this reason, organizations should test the current PSU in their environment in anticipation of these fixes being included in the next CPU.

What is the difference between a Java CPU and PSU release?

Java SE Critical Patch Updates (CPU) contain fixes to security vulnerabilities and critical bug fixes. Oracle strongly recommends that all Java SE users upgrade to the latest CPU releases as they are made available. Java SE CPU releases are odd numbered versions (i.e. 7u71, 7u65 – see more on Java SE version numbering schemes here).

Java SE Patch Set Updates (PSU) contain all of fixes in the corresponding CPU, as well as additional non-critical fixes. Java PSU releases should only be used if you are being impacted by one of the additional bugs fixed in that version. The release notes call out the additional fixes available in Java SE PSU releases.

Is the cadence of CPU releases changing?

As before, Java SE CPU releases are scheduled for release on the Tuesday closest to the 17th day of January, April, July and October under the normal Oracle Critical Patch Update schedule.

Starting in October 2014 with the release of Java SE 7u71 (CPU) and Java SE 7u72 (PSU), Oracle plans to additionally release a corresponding PSU release along with each CPU release for Java SE 7. PSU releases provide organizations and developers with access to non-critical fixes in addition to the critical fixes contained in the corresponding CPU.

Use u73 unless you know you need a bug fix that's in u74.