Apache NiFi 1.x end of life
Apache NiFi 1.x reached end of support on 8 December 2024, according to the NiFi download page. The final release, 1.28.1, shipped on 19 November 2024, and all development has moved to 2.x. NiFi 2 requires Java 21, replaces flow.xml.gz with flow.json.gz and removes the variable registry, so moving from 1.x is a migration, not an upgrade.
What now
Which vendors provide Apache NiFi 1.x security patches now that support has ended?
Apache NiFi extended support- End of life
- 8 December 2024 (end of support)
- Released
- Aug 2016
- Final release
- 1.28.1
- Successor
- NiFi 2.x
Date published by Apache NiFi download page and Migration Guidance. We do not publish a lifecycle date we cannot source.
Last reviewed
Apache NiFi versions: release and end-of-life dates
| Version | Released | End of life | Status |
|---|---|---|---|
| Apache NiFi 1.x (this page) | 31 Aug 2016 | 8 December 2024 (end of support) | End of life |
End-of-life dates are published by each project and checked against endoflife.date.
What actually stops on 8 December 2024
- All releases on the 1.x line — 1.28.1 was the last
- Security fixes for NiFi's own code and for the libraries bundled in its NARs
- Fixes for processors that were removed in 2.x and therefore exist only on 1.x
What actually breaks in the upgrade
You cannot go straight to 2.0
NiFi's migration guidance states that migrating to 2.0.0 requires upgrading to 1.27.0 first. Estates on 1.19 or 1.23 therefore face a two-step path, and the first step is itself a production change that needs validating.
What 2.0 actually removed
Java 21 is required. flow.xml.gz is replaced by flow.json.gz. The VARIABLE_REGISTRY expression-language scope is gone, in favour of parameter contexts. Servlet packages moved from javax to jakarta, which breaks custom UIs and NARs built against the old API. And a substantial list of deprecated processors, controller services and reporting tasks no longer exists.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Migrate to NiFi 2.x | Via 1.27.0 or later. | Flow rebuild and revalidation against real data | Engineering time, scheduled around downstream consumers | The destination. Inventory processors first — the gap analysis is where the real effort is found. |
| OSSeva extended support | Patched 1.x builds, canvas untouched. | Drop-in | Per cluster | Closes the security gap while the migration is scoped from a real processor inventory. |
What OSSeva does for Apache NiFi 1.x
OSSeva patches this line
OSSeva ships patched NiFi 1.x builds with flow.xml.gz, the NAR set, parameter contexts and controller services unchanged.
Apache NiFi extended support
Apache NiFi extended support What your auditor will say
Requires that system components are protected from known vulnerabilities by installing applicable security patches. A release line with no upstream patch stream cannot meet this by itself, whatever the scanner reports.
Vulnerability identification and remediation. Scanning satisfies identification. Remediation is what fails when the fix does not exist for the line you run.
Is Apache NiFi 1.x end of life?
Yes. The NiFi download page gives 8 December 2024 as the end of support for 1.x. The final 1.x release was 1.28.1 on 19 November 2024 and no maintenance branch backports fixes to it.
Can we upgrade directly from NiFi 1.x to 2.0?
Only from 1.27.0 or later. NiFi's migration guidance requires upgrading to 1.27.0 before moving to 2.0.0.
Does NiFi 2 require Java 21?
Yes. That alone is a migration for estates still running NiFi on Java 8 or 11.
Get a quote
Still running Apache NiFi 1.x?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.
Prefer to talk or read more first?