Lucee update if ain't broke don't fix it?

dev support
1

We are on windows 2019 with Lucee 5.4.4.38.
There’s a critical application that’s been running there for many years without any issues and still no issues all running smoothly.
We want to update to at least Lucee 6 but is it truly necessary? Mainly thinking abut security etc.
For some reason we are reluctant to press the button thinking something might go wrong.
Any thoughts please?

2

Hi, good question, and being careful with a critical app makes sense. The main reason to move is security: Lucee 5.4 reached end of life on December 31st 2025 (announcement), so it no longer gets security fixes, and 5.4.4.38 also misses the later 5.4 patches. The Java and Tomcat on that server are probably outdated as well.

I’d recommend a fresh install of the current 7.1 rather than an in-place upgrade. Copy your .CFConfig.json from lucee-server/context into the new install, test on a staging copy first, and go through the Lucee 5 to 6 migration guide and the breaking-changes pages it links to.

Also good to know: we’ll soon make Lucee 7.1 the LTS version, and after that 6.2 will reach end of life as well. We’re here to help you sort out any issues along the way.

3

hi, thank you for your reply we shall make those updates.

4

Pretty much, if you have an existing app and don’t care about new features, security updates are really the focus and should compel you to stay on a supported version. If your server is public facing, updating it to keep up with security updates should be a normal process, since some of those vulnerabilities they’ve identified in the last several years are pretty impactful. When you update the Lucee version, you are also upgrading the underlying Java and Tomcat versions that have a ton of patches in them.

5

That’s great thanks and cheers for highlighting that updating Lucee will also upgrading the underlying Java and Tomcat versions, good to know.

6

@quetwo That’s exactly why we have LTS versions. If you don’t need the latest features, just stay on the LTS. You get:

  • security fixes for as long as it’s the LTS,
  • a well-tested release rather than the cutting edge (7.0 came out almost a year ago),
  • a stable target: no functional changes, only bug fixes. 6.2 has been the LTS for close to a year now.

We’ll soon move the LTS from 6.2 to 7.1, and 8.0 will then be the cutting-edge release. We’re also already working on Lucee 9 and making good progress.