Develop Reference

Why should i update a java jdk 1.6 web application and what is the risk to not do it?

Today i received a request to make a plan to update an web application deployed in a tomcat 7 to Java 1.8 and the reason was the web site security.
So i would like to know if is really important to update our web application to java 1.8 and the real problems if we keep our server using java 1.6 deployed in a tomcat 7 ?
best regards

The biggest risk is probably not for your application. The risk from your customer's perspective is that the Java 6 runtime is vulnerable to many things. If your application only supports Java 6, they need to have that on their workstations, which they don't want to, because it makes their workstations vulnerable.
Your app may also be vulnerable if running on Java 6, see the list of updates here for example. It depends whether you are using any API that had a security vulnerability since then. But my guess is your customer is primarily worried about their workstations.

Most java 1.6 code should compile and be fine with version 1.8 of java.
Things what are already marked as deprecated in java 1.6 (or earlier) may have been removed from a later release (1.7 or 1.8). Any of these will be obvious if you just compile your existing code with a java 1.8 compiler.
As mentioned in another answer, security risks of java 1.6 are a good reason to upgrade. Also versions 1.7 and earlier are already officially end-of-lifed by Oracle so only version 1.8 gets public security updates. It is possible to get a subscription to for java 1.7 security updates from Oracle. I'm not sure if there is one available for any other versions of java.
Another concern may be "is there a java 1.8 version of my JEE container."
1.8 has been out for a while so I suspect that the answer is "yes".
Here is the Oracle Compatibility Guide

Last JDK 1.6 and JDK 1.8 update in 2016-07-19. All platform supported now but only Java 8 have public security updates. It's a good reason for update your jre/jdk. Java 8 support most feature of Java 6, you don't have problem with compilation. But some of methods be deprecated.
The conclusion is that we need to use technologies that are supported by
the developer to the full.

Should I keep compiling against older versions of Java?

Since the release of Java 8, I found myself slowly becoming dependent on Java 8-specific features (ex. lambda statements) on a library project that I have just started.
I have seen many other projects which, to this day, still build against Java 7, or even Java 6, causing me to second-guess myself.
Is it a good idea to immediately start building against the newest version of Java, or should I still use older versions?
Note that unlike those other projects that have started back when Java 6/7 was the newest version, mine was started recently when Java 8 is the newest.

There are two reasons I can think of that would require staying with a pre-Java 8 JVM:
You are writing a library that is being used by a large group of people outside your organization who are still stuck on a pre-Java 8 JVM. If you use the latest and greatest JVM, they won't be able to use your product anymore.
You are dependent on a 3rd party library that has not upgraded to Java 8 and breaks on Java 8.
Since you mentioned this is a new project, #1 is unlikely. Even if you plan on having external users, if it's a new project, requiring the latest version of the JVM isn't really an issue.
Number 2 is also getting more and more unlikely as the more popular 3rd party libraries have released updates to work on Java 8. Even the few stragglers are usually OK working on Java 8. For example I use an ancient version of hibernate with Java 8. I just don't use any Java 8 features in any mapped fields/entities.

Java 8 denotes a major change to the language since Java 5 (or perhaps its inception). If you are targeting specifically the changed language parts (which I guess you claim) then making it usable only by Java 8+ runtime makes sense.
When Java 5 occurred 10 years ago and you wanted to use all the new features introduced at the time (e.g. foreach statement, Enums etc.) into your own library development, what would you have done? I believe you would have made your library require Java 5 at the minimum. If you agree with that, then that (sound) logic applies consistently to your present situation as well.

For server side application, possibly a version or two prior to the current version as suggested by EJP.
On the client side however, I don't see any point in trying to support older Java versions. The JRE has been auto-updating since at least Java 6. It has gotten to the point where Java Web Start launched applications cannot specify an earlier than current JRE. Or rather, it can specify any JRE it chooses in the launch file, but that will be ignored in favor of the latest version installed on the user's computer.

Java Downward compatibility clarification

I need a little clarification regarding JRE. Is it downward compatible? I mean if I develop an application using java5 and if the target has the latest java6 will my application be able to run?

unless you are using the incompatibilities listed in sun documents Compatibility

Yes, provided you're not using really old deprecated APIs (like, ones deprecated in v1.1)...and maybe even then.
That's APIs. The bytecode is absolutely forward-compatible. It's been revised a couple of times, but always in a forward-compatible way. So code compiled with JDK 1.4 runs fine in the latest; but code compiled with the latest may not run with an older JVM.

Yes - Java's very good about that.

I'm writing about it here java backwards compatibility.

The bytecodes generated can be run in future releases of jvm however the compiler is not backward compatible as bytecodes generated with higher version won't run in older version. This is a good read on Sun site here

What do I need to know about the different versions of Java from a .NET perspective?

I'm not sure how to phrase this question, but considering the differences in .NET listed below, is there any comparison to Java and all it's deployments?
Platform
The same version of .NET can run on either a server or workstatation
Since the full version of .NET may be too much for some deployments, there is a client profile only version
Silverlight and .NET are not binary-compatible.
There are additional versions of .NET that are meant for other platforms. They are not binary compatible, and may have different API's available: (.NET Micro, Mobile, CE, Embedded, Mono)
Changes between versions
The CLR is version "1.x" in .NET versions 1.0 and 1.1
The CLR is version "2.x" in .NET versions 2, 3.0, and 3.5
.NET 3.0 adds WF and WCF
.NET 3.5 is mostly a feature pack on top of the .NET 2.0 "base"
A .NET 2.0 application will run if only .NET 3.x is installed, but what may appear as a version mismatch doesn't apply to any other assembly/.NET build combination
Given all the different versions of Java SE EE and all the acronyms, I'm sure there may be more under the hood I need to learn besides the spelling difference between each implementation.
Can you tell me what I need to know regarding the various versions that exist and when is one more appropriate than the other.
http://www.oracle.com/technetwork/java/index.html

Until now if a program ran under any release of Java SE - Java 1.1, Java 1.2, Java 1.3, Java 1.4, Java 5, Java 6 - it runs under any later release too (except for unintentional bugs, but these has been very few).
Sun has given this extreme attention, and it has meant that upgrading has been a non-issue. You just do it. With the advances achieved in the JVM this has also been highly desirable.
Hence, unless you have very good reason not to, your users should use Java 6. The Sun Java 6 gives very good performance but at the cost of memory to do so.
I have only worked with the "web application" part of Java EE, but here the Servlet API has been very stable and well supported. A given WAR file can be deployed on any web container, plus some configuration glue. This includes web containers much newer than the specification the web application was written against.

I think all you need to know is that Java JDK 6 is the only one that's currently supported by Oracle. The other earlier versions have all passed their useful support life.
There's no good reason on earth for anybody to be running a JDK or JRE version 1.4 or earlier. It doesn't even have generics, and it's missing a number of important improvements to the memory model.
JDK 5 is defensible, but I believe it's already reached the end of its support life as well.

Known incompatibilities between Java 1.4 to Java 5

A list of potential compatibility problems is provided by Sun: http://java.sun.com/j2se/1.5.0/compatibility.html.
Have you encountered other problems when running/testing old-1.4-applications against Java 5 (e.g. A specific library no longer working ....)?

The Java 1.5.0 deprecated list may be of help.

You may discover an alternative list of backward compatibility problems in all versions of JDK including 1.4 and 1.5 at the following web-sites:
JDK-Results at Japitools Home Page:
In an ideal world each JDK version would be perfectly backward compatible with the one before. As the following table shows, in reality this is not the case ...
Test results for JDK at Java Upstream Tracker:
This service is aimed at monitoring and analyzing Java libraries development. It is looking for new releases of various libraries and checking them for backward binary and source compatibility ...
These results were obtained by static analysis tools and can be used together with the official compatibility notes (Incompatibilities in J2SE 5.0 since 1.4.2 from Sun/Oracle).

In general, code that runs under 1.4 should work under 1.5. I don't think any previously deprecated methods were even removed. However, bugs are fixed between releases and you might get some slightly different behavior if your application was written in such a way that depended on the bug (I have encountered this with a Swing application).