OSSEVA FOR APACHE NIFI
NiFi 2.0 moved on. Your 1.x flows could not.
Apache NiFi development has moved entirely to the 2.x line — 2.11.0 shipped 3 August 2026. The 1.x line ended at 1.28.1 and receives no further releases. NiFi 2.0 requires Java 21 and dropped dozens of processors, so the upgrade is a flow rebuild rather than a version bump.
Why now
The 1.x line has stopped
NiFi 1.28.1 was the end of the 1.x series. All development, all fixes and every release since have gone to 2.x. There is no 1.x maintenance branch receiving security patches, and there will not be one — which leaves every production 1.x canvas permanently exposed to anything disclosed from here on.
NiFi 2.0 removed processors that live in production flows
The 2.0 release raised the Java baseline to 21 and removed a substantial set of deprecated processors, controller services and reporting tasks. Flows built over years against those components do not import cleanly. The upgrade is a rebuild-and-revalidate exercise against real data, scheduled around whatever those flows feed.
NiFi holds credentials for everything it connects to
A NiFi instance stores database passwords, cloud keys, SFTP credentials and API tokens in its parameter contexts and controller services, and routes regulated data between them. Authentication and authorisation advisories in NiFi are not confined to NiFi — they reach every system in the canvas.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| 1.19.x(1.x line ended — OSSeva patched) | EOL | Clean |
| 1.23.x(1.x line ended — OSSeva patched) | EOL | Clean |
| 1.26.x(1.x line ended — OSSeva patched) | EOL | Clean |
| 1.28.x(Final 1.x release — OSSeva patched) | EOL | Clean |
| 2.x(Upstream maintained) | Current | Clean |
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
CVE patches for NiFi 1.x with the canvas untouched.
- Security backports across the 1.x line, flows unchanged
- Authentication, authorisation and policy advisory coverage
- Bundled NAR dependency patching (Jetty, Jackson, Netty)
- Docker / tarball delivery
- Signed artifacts (GPG)
- Flow inventory and 2.x migration assessment
- 24/7 managed operations
OSSeva Assure
Patch plus a processor inventory mapped against what 2.x removed.
- Everything in Patch
- Full processor and controller service inventory
- Removed-component gap analysis against NiFi 2.x
- Parameter context and credential handling audit
- SOC 2 / HIPAA attestation package
- Costed flow migration plan to 2.x
- 24/7 managed operations
OSSeva Operate
Full MSP: 24/7 dataflow monitoring, 15-min SLA, named NiFi engineers.
- Everything in Assure
- 24/7 queue backpressure and flow throughput monitoring
- 15-minute P1 incident response SLA
- Named senior NiFi engineer
- Content and provenance repository management
- Flow migration execution to NiFi 2.x
- Quarterly dataflow and capacity reviews
All tiers priced per cluster/application — not per core. Contact for pricing →
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
# Version of a running instance
curl -s -k https://nifi:8443/nifi-api/system-diagnostics \
| jq '.systemDiagnostics.aggregateSnapshot.versionInfo'
# Every processor type on the canvas — the 2.x gap analysis starts here
curl -s -k https://nifi:8443/nifi-api/process-groups/root/processors \
| jq -r '.processors[].component.type' | sort | uniq -c | sort -rn# Same flow.xml.gz, same NARs, patched dependencies
docker pull artifacts.osseva.io/nifi:1.28.1-osseva-1
docker run -d --name nifi \
-p 8443:8443 \
-v /opt/nifi/conf:/opt/nifi/nifi-current/conf \
-v /opt/nifi/state:/opt/nifi/nifi-current/state \
artifacts.osseva.io/nifi:1.28.1-osseva-1Migrate from Unsupported NiFi 1.x deployments
OSSeva patches the 1.x line in place so the existing canvas, NARs and parameter contexts keep working exactly as configured. The move to 2.x is then scoped from a real processor inventory — including which removed components need replacements built — rather than discovered halfway through a migration window.
Pricing model
OSSeva for Apache NiFi is priced per cluster — not per flow, processor or volume of data moved.
Frequently asked questions
Which versions of RabbitMQ are past community end-of-life?
RabbitMQ 3.8.x, 3.9.x, 3.10.x, 3.11.x, and 3.12.x have all reached community EOL — meaning no further security patches or CVE fixes are released by the RabbitMQ maintainers for those versions. RabbitMQ 3.13.x reached EOL in late 2024. OSSeva delivers backported CVE patches for 3.11 through 3.13.
Which PostgreSQL versions are no longer receiving community security patches?
PostgreSQL 9.6 through 13 have all reached community EOL. PostgreSQL 11 reached EOL November 2023, PostgreSQL 12 reached EOL November 2024, and PostgreSQL 13 reaches EOL November 2025. OSSeva provides extended security patching for PostgreSQL 11, 12, and 13 for teams that cannot immediately migrate to PG 14 or later.
Is Spring Framework 5.3.x still supported?
Spring Framework 5.3.x reached its community OSS EOL on December 31, 2024. Broadcom's commercial support for Spring 5.3.x is also no longer available under standard terms. OSSeva delivers backported CVE patches for Spring Framework 5.3.x and Spring Boot 2.7.x under our extended lifecycle support program.
Which versions of Apache Kafka are EOL?
Apache Kafka versions 2.x and 3.0 through 3.4 are past their community supported window, meaning no further patch releases. Kafka 3.5 and 3.6 have reached or are approaching EOL. OSSeva supports Kafka 2.8 through 3.5 with backported security patches and compliance documentation.
What happened to Redis licensing? Can I still use Redis for free?
In March 2024, Redis Ltd. changed the Redis license from BSD-3-Clause to the Business Source License (BSL 1.1), which restricts use in competing database products. The Valkey project (a Linux Foundation fork) continues under BSD-3-Clause. OSSeva maintains BSD-licensed, CVE-patched builds of Redis 6.2 and 7.0 for enterprises that need verifiable open-source licensing alongside security coverage.
Is Node.js 18 still receiving security patches?
Node.js 18 (LTS 'Hydrogen') reached its end-of-life date in April 2025 and no longer receives security releases from the Node.js project. OSSeva delivers CVE patches for Node.js 18 for enterprise teams that have not yet migrated to Node.js 20 or 22.
Is Apache Tomcat 8.5 still supported?
Apache Tomcat 8.5 reached its community EOL in March 2024. OSSeva provides extended security patching for Tomcat 8.5.x for teams running Java EE 7 workloads that cannot immediately migrate to Tomcat 9.0 or 10.1.
What .NET versions does OSSeva support?
.NET 6 reached Microsoft end-of-support in November 2024. .NET 7 reached EOL in May 2024. OSSeva delivers CVE patches for .NET 6 and .NET 7 for teams that have not yet migrated to .NET 8 (LTS, supported through November 2026).
Ready to get Apache NiFi patched and supported?
Start with a 45-minute discovery call. We confirm your version coverage, scope the engagement, and have you onboarded within your first quarter.