End of life

Apache ZooKeeper 3.7 end of life

Apache ZooKeeper 3.7 reached end of life on 19 January 2024, with 3.7.2 as its final release. Only the 3.8 and 3.9 lines still receive security fixes. ZooKeeper is stable enough that ensembles routinely run untouched for years, so the installed base sits well behind that line.

End of life
19 January 2024
Released
Mar 2021
Final release
3.7.2
Successor
ZooKeeper 3.8 or 3.9

Date published by Apache ZooKeeper release history, cross-checked against endoflife.date. We do not publish a lifecycle date we cannot source.

What actually stops on 19 January 2024

  • Security fixes for the 3.7 branch, including the bundled Netty, Jetty and logging libraries
  • Any further 3.7.x releases

What actually breaks in the upgrade

Rolling upgrades work, if quorum holds

ZooKeeper supports replacing members one at a time with the ensemble continuously available. The constraint is not the ensemble, it is the version skew tolerated by every client above it — Kafka, Solr, HBase, NiFi, Hadoop — which is why the dependency map has to come before the first node is touched.

Kafka's KRaft migration does not remove the ensemble

Removing ZooKeeper from Kafka leaves every other dependent system exactly where it was. In most estates the non-Kafka ensembles are the older ones, precisely because they have had less attention.

Your options, costed honestly

Including the ones that do not involve buying anything from us.

OptionWhat it isEffortCostOur view
Rolling upgrade to 3.8 or 3.9Replace members one at a time, quorum preserved.Coordinated with every client systemEngineering timeThe right destination, and achievable without downtime in most topologies.
OSSeva extended supportPatched 3.7.x builds.Drop-inPer ensembleSecures the ensemble without requiring every dependent system to move at once.

What OSSeva does for Apache ZooKeeper 3.7

OSSeva patches this line

OSSeva ships patched ZooKeeper 3.4 through 3.7 builds, including the bundled dependency set where most recent ZooKeeper advisories have originated.

Apache ZooKeeper extended support

What your auditor will say

PCI DSS v4 Requirement 6

An ensemble holds the configuration and access-control state for the systems it coordinates, which places it in scope alongside them. Write access to ZooKeeper is effectively administrative access to the cluster above it.

SOC 2 CC6

Logical access control. Unrestricted four-letter-word commands and permissive ACLs on an ensemble are a recurring finding, and they are easy to demonstrate to an assessor.

Compliance library

Apache ZooKeeper 3.7: common questions

Is Apache ZooKeeper 3.7 end of life?

Yes, since 19 January 2024. Before it, 3.6 ended on 30 December 2022, 3.5 on 1 June 2022 and 3.4 on 1 June 2020. Only 3.8 and 3.9 still receive upstream fixes.

Can an ensemble be upgraded without downtime?

Usually. ZooKeeper supports rolling upgrades when quorum is preserved, so members are replaced one at a time. The real constraint is the version skew tolerated by the clients above it, which is why the dependency inventory comes first.

Still running Apache ZooKeeper 3.7?

Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.