What's the difference between JDK 8u91 and 8u92?

Question

The Oracle website seems to be recommending version 8u91 when you click on "Java for your computer". But when you click "Java for Developers", it gives two options: 8u91 and 8u92. What's the difference? Generally I would assume the highest version number is best, but in this case, I'm not sure.

Answer 1

The Oracle website is clear: use 8u91 (the 'CPU' release) under all circumstances except where you specifically require fixes present in the 'PSU' release (8u92, in this case). The difference between CPU and PSU releases is explained via a link on the release page.

For future reference, the exact quote from the Oracle release blog is:

JDK 8u91 and 8u92, two new Java 8 updates are now available. Oracle strongly recommends that most Java SE users upgrade to the latest Java 8u91 CPU release, which includes important security fixes. Java SE 8u92 is a patch-set update, including all of Java 8u91 plus additional features. You can download the latest JDK releases from Java SE Downloads page...

Answer 2

It's a matter of perspective. What Derek didn't quote was:

Java SE Patch Set Updates (PSU) (i.e. u92) contain all of fixes in the corresponding CPU (i.e. u91), as well as additional non-critical fixes. Java PSU releases should only be used if you are being impacted by one of the additional bugs fixed in that version.

For that you need to read the Release Notes and see if you need the additional fixes.

Answer 3

JDK 8u91 and 8u92, two new Java 8 updates are now available. Java SE 8u92 is a patch-set update, including all of Java 8u91 plus additional features. Please check the release notes below for JDK 8u91 and 8u92

Answer 4

What I think also should be quoted:

The subsequent CPU release will contain all of the fixes from the current PSU.

i.e. 8u101 should contains all changes and fixes that were in 8u92 but not in 8u91. However when I look at the release notes of 8u92 and 8u101 there are some new jvm options in 8u92 (ExitOnOutOfMemoryError and CrashOnOutOfMemoryError) but they are not in 8u101...

Answer 5

The quick answer is that a "Critical Patch Update" (or CPU, the first in these pairs) is a quarterly update, and a "Patch Set Update" (or PSU) is a situational update that tries to fix issues found in its CPU predecessor, released before the next CPU is officially marked golden.

Here's a post that describes what's up a bit:
CPU, PSU, SPU - Oracle Critical Patch Update Terminology Update.

Critical Patch Update (CPU) now refers to the overall release of security fixes each quarter rather than the cumulative database security patch for the quarter. Think of the CPU as the overarching quarterly release and not as a single patch.

---

You should be confused

Oracle really isn't doing a great job making the difference, theoretical or practical, between CPU & PSU clear.

For example, on the release notes for 8u111 and 8u112, I could find any reason not to use the latest PSU, currently 8u112. But neither did the release notes by themselves give me a great reason why I would use the PSU!

There was a "Changes" section for 112 that included "security-libs/java.security-- SunPKCS11 Provider no longer offering SecureRandom by default", but no mention of other serious issues.

But if you google around around enough, you do find serious issues, like...

JVM throws NullPointerExceptions on macOS Sierra 10.12

On macOS Sierra 10.12, if a user presses modifier keys (such as Command, Alt, Shift) while an applet is running in a browser, an error box named “Internal Error” might be displayed. It will also show the “exec” icon in the macOS dock. The user can dismiss the applet, or try to rerun the applet while not pressing a modifier key. To fix this problem, install JRE 8u112, for Mac OS X. [emphasis mine]

I mean, technically, that issue is on the bug page, which itself is a link or two removed from the release notes, down at #42, [macos] JVM continuously throw a NullPointerException on new MacOS 10.12, but finding that isn't user friendly. It's going to take some work to see if it's mission critical for you to use a PSU.

TL;DR

Best guess is that CPUs are well QA'd and Oracle can't be as confident with PSUs, as they're basically in-progress previews of the upcoming, as-yet-unreleased, quarterly CPU.

But since they can tell everyone who uses macOS Sierra to use a PSU, for example, a PSU is probably good enough for development, and does a decent job anticipating the next CPU. You wouldn't necessarily deploy it to a production server unless one of the PSU fixes wasn't mission critical for you, but you probably could, depending on how comfortable your organization was with edge releases.

But Oracle should say all this somewhere a little more clearly, or we're stuck with this question.