# Arch Linux: jre19 openjdk EOL dependency **URL:** \ **Category:** Elasticsearch\ **Created:** [April 29, 2023, 11:15am UTC](https://discuss.elastic.co/t/arch-linux-jre19-openjdk-eol-dependency/331124 "2023-04-29T11:15:51Z")\ **Posts on this page:** 1\ **Showing post:** 4
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [April 29, 2023, 12:28pm UTC](https://discuss.elastic.co/t/arch-linux-jre19-openjdk-eol-dependency/331124/4 "2023-04-29T12:28:24Z")
> [@D3vil0p3r](#): > > I'm just concerned to use a dependency that reached EOL mostly for security concerns. That's the advantage of using the bundled version: it's not a dependency that you need to track separately. It's just part of the product, similarly to Lucene and Log4J and Jackson and all the other libraries on which Elasticsearch depends. Elastic looks after the security side of things, so a vulnerability(\*) in the bundled JDK would be reported as an [Elastic Security Advisory](https://www.elastic.co/community/security). (\*) NB not all vulnerabilities reported in a dependency are vulnerabilities in the dependent product. For instance most Elasticsearch releases [were not vulnerable to the famous Log4J bug reported in CVE-2021-44228](https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476#elasticsearch-mitigation-summary-matrix-37). Similarly, there have been a number of Jackson vulnerabilities that did not affect Elasticsearch because Elasticsearch did not use the vulnerable features in the library. --- _[View the full topic](https://discuss.elastic.co/t/arch-linux-jre19-openjdk-eol-dependency/331124)._