Removing outdated UI5 versions from UI5 CDN

[OliverGraeff]

Update December 15, 2021: SAP moves forward safeguarding an up-to-date and secure environment which benefits from SAP's enterprise support. As announced in this blog post in January 2021, the UI5 team will delete UI5 versions on the UI5 CDN beginning with:

• SAPUI5 / OpenUI5 1.22, 1.24, 1.26 in mid of January 2022


• SAPUI5 / OpenUI5 1.28, 1.30, 1.32 in mid of March 2022

Note that a version is fully maintained for the full quarter listed as "End of Cloud Provisioning" in the SAPUI5 Versions Maintenance Status. The version will be deleted right after this quarter. It is planned to have all versions removed by end of Q2/2022, for which the End of Cloud Provisioning has passed. Applications using such versions will stop working. To stay up to date on this, please see The UI5 team reaches out to You.

---

Update August 16, 2021: The UI5 team wants to re-iterate the importance of this topic. We can see that outdated UI5 versions are still in use by few customers. Please note that once these are removed, applications will break. To avoid a potential security risk, please update to a more recent version as described in this blog post.

---

SAP sees Security as an essential topic, investing heavily in all product areas and fulfilling respective legal compliance. We are committed to identify and address security issues affecting our software and cloud solutions. This is reflected in a number of Security Offerings including SAP Security Patch Days. UI5 implements latest security patches in order to fix potential vulnerabilities. SAP strongly recommends that customers apply patches on a priority to protect their SAP landscape. For SAP Business Technology Platform, we always recommend upgrading to the latest SAPUI5 version. It includes the latest capabilities, patches and security fixes.

The UI5 team wants to emphasize the importance of this topic as some outdated UI5 versions are still in use. To ensure outdated versions are no longer posing a potential security risk, it is common practice to remove them from cloud delivery. We decided to

Remove SAPUI5 / OpenUI5 versions from the CDN one year after their end of maintenance. In addition, also patches of versions in maintenance which are older than one year will be removed.

See the maintenance status of the UI5 version in the SAPUI5 version overview and the OpenUI5 version overview respectively. The UI5 version/patch is available until the end of the given quarter and being removed soon afterwards.We begin with the removal in Q3/2021 so that all affected SAP customers and partners have time to react. Depending on your initial situation and whether you want to adopt latest SAP Fiori innovations, our recommendation is to upgrade to a long-term maintenance version:

• to SAPUI5 / OpenUI5 1.38 from versions below 1.38


• to SAPUI5 / OpenUI5 1.71 / 1.108 from other versions

In general, also plan to regularly consume the latest patch level of the respective version.

Please notice: this in no way means a change in the maintenance strategy / support duration of UI5 versions: Affected are UI5 versions on CDN one year after their end of maintenance.For your reference see SAP note 3001696 and further information on developing and running secure SAPUI5 apps in Securing Apps. Also see more details on SAPUI5 versioning, upgrading and compatibility rules.

To access the SAPUI5 documentation for outdated on-prem versions, go to the SAP NetWeaver product page, click on your platform version, click on the UI Technologies link and then on SAPUI5: UI Development Toolkit for HTML5. This will open the respective SAPUI5 documentation version.