JEP draft proposes finalizing structured concurrency as standard in JDK 28

A JEP draft proposes finalizing Structured Concurrency as a standard feature in JDK 28, introducing the StructuredTaskScope API to the java.util.concurrent package. The feature, which has gone through multiple preview rounds since JDK 19 (JEP 428), lets developers treat groups of related tasks running on different threads as a single unit of work, simplifying error handling, cancellation propagation, and observability compared to the unstructured ExecutorService/Future model. The proposal for JDK 28 carries no API changes from JDK 27's JEP 533, which added a type parameter for the exception thrown by join(). The document details the StructuredTaskScope interface, fork/join workflow, built-in and custom Joiners, cancellation semantics, scoped value inheritance, exception handling patterns, configuration options (timeouts, thread factories), thread-dump observability enhancements, and alternatives considered and rejected, such as enhancing ExecutorService directly or having fork return a Future.

Kotlin Toolchain 0.12 adds multiplatform library publishing and Wasm app support

Kotlin Toolchain 0.12.0 adds preview support for publishing multiplatform libraries (not just JVM), a preview of building Wasm web applications, and Compose Hot Reload usable from the command line, including a new MCP server letting AI agents interact with hot-reloading apps. It also tightens Maven Central publication compliance, improves terminal UI diagnostics and test status, adds IDE improvements for Compose preview, Android tooling, and iOS run configurations, introduces a new '//' prefixed local dependency path format, raises the minimum supported JDK to 17 and minimum Kotlin compiler to 2.2.20, and bumps default versions for Kotlin, JDK, JUnit, KSP, Ktor, Spring Boot, DataFrame, and kotlinx.rpc.

Apache Tomcat, Chrome 152 and asyncssh receive critical security patches

Quarkus 3.39 adds post-quantum cryptography support to TLS registry

Quarkus 3.39 introduces post-quantum cryptography (PQC) support in the TLS registry, wiring the Vert.x PQC API through the HTTP server, HTTP client, REST client, and mailer. Three new config properties let developers set key exchange groups (like ML-KEM), enforcement policy (strict, client-negotiated, relaxed), and SSL engine selection. The reflection-free Jackson serializers, previously enabled by default, have been reverted to opt-in due to remaining stability issues ahead of the upcoming LTS release. Various platform components were also upgraded, including Camel Quarkus, Quarkus CXF, Quarkus Flow, LangChain4j, Operator SDK, and Qpid JMS.

Quarkus Flow 1.0.0 ships as lightweight embedded workflow engine with LangChain4j integration

Quarkus Flow 1.0.0 has shipped as the first stable release of a lightweight workflow engine for Quarkus, built on the CNCF-sandboxed Open Workflow Specification. It runs embedded in the Quarkus runtime with no extra services, supports both YAML and a Java DSL for workflow definitions, and integrates with LangChain4j for agentic AI orchestration. Other features include CloudEvents messaging via SmallRye Reactive Messaging, state persistence (JPA, MVStore, Redis), OpenTelemetry/Micrometer observability, OIDC/OAuth2 security, Kubernetes Leases for durable workflows, a Dev UI panel, and GraalVM native image support. The 2.0.0 milestone targets Quarkus 4 with MCP client/server tasks, A2A protocol support, and a REST endpoint for workflow instances, while 1.1.0 will target Quarkus 3.40.0 LTS by end of September.

Spring Framework update fixes 91 vulnerabilities across 209,000 affected components

<h2>What shipped</h2>
<p>After a ten-week gap, a wave of Spring milestone releases landed at once: Spring Boot 4.2.0-M1, Spring Framework 7.1.0-M1, Spring Data 2026.1.0-M1, Spring Security 7.2.0-M1, Spring Integration 7.2.0-M1, Spring HATEOAS 3.2.0-M1, Spring Modulith 2.2.0-M1, Spring Batch 6.1.0-M1, Spring AMQP 4.2.0-M1, and Spring for Apache Kafka 4.2.0-M1. Maintenance releases for Spring Modulith (2.1.1, 2.0.8, 1.4.13) also came out alongside the milestone.</p>
<h2>Notable changes</h2>
<p>A few things stand out across the releases:</p>
<ul>
<li><strong>Spring Boot 4.2.0-M1</strong> adds AMQP 1.0 support via RabbitMQ and switches to Jetty’s GracefulHandler for shutdown.</li>
<li><strong>Spring Framework 7.1.0-M1</strong> introduces a new <code>forParameter()</code> factory method.</li>
<li><strong>Spring Data 2026.1.0-M1</strong> includes initial <code>RedisJsonTemplate</code> support.</li>
</ul>
<h2>Security fixes</h2>
<p>This is the part worth paying attention to. Over 91 CVEs were patched across the ecosystem. The ones with real teeth:</p>
<ul>
<li><strong>CVE-2026-59307</strong> - A Java deserialization RCE in Spring Integration.</li>
<li><strong>CVE-2026-59321</strong> - A message-corruption bug in scripting engines.</li>
<li><strong>CVE-2026-47860</strong> - A denial-of-service in Spring AMQP via oversized compressed messages.</li>
<li><strong>CVE-2026-59271</strong> - RabbitMQ admin passwords leaking in exception messages.</li>
</ul>
<p>Sonatype flagged that these patches affect roughly 209,569 software components. Broadcom’s advisory volume reportedly jumped over 1,700% between March and April, which Sonatype CTO Brian Fox attributes to AI giving both defenders and attackers faster ways to find vulnerabilities - essentially compressing the window between discovery and exploitation.</p>
<p>The practical advice from Sonatype: automate patch deployment, look into virtual patching, and audit your open source dependencies. Many volunteer-maintained projects simply can’t keep up with rapid patch cycles, so rationalization matters.</p>
<h2>Where to follow along</h2>
<p>Josh Long’s “This Week in Spring” roundup covers these releases alongside a RabbitMQ vs. Kafka comparison and other community content. He’ll be at JavaZone, IntelliJ IDEA Conf, and KCDC if you want to catch him in person.</p>


A batch of Spring ecosystem milestone releases shipped together after a ten-week gap, including Spring Boot 4.2.0-M1, Spring Framework 7.1.0-M1, Spring Data 2026.1.0-M1, Spring Security 7.2.0-M1, and several others, bringing new features like AMQP 1.0 support and RedisJsonTemplate. More significant is a batch of 91 CVE fixes across the ecosystem, including a Java deserialization RCE in Spring Integration and a RabbitMQ password-leak bug. Sonatype notes the patches affect over 209,000 software components and that Broadcom's advisory volume jumped over 1,700% between March and April, attributed partly to AI accelerating both vulnerability discovery and exploitation.

JDK 27 reaches release candidate with compact headers and post-quantum TLS

<h2>JDK 27 ships September 15, 2026</h2>
<p>JDK 27 has hit release candidate with nine JEPs locked in since June 4, 2026. General availability is September 15, 2026. Early access builds are already out if you want to kick the tires.</p>
<h2>What’s final in JDK 27</h2>
<p><strong>Compact Object Headers (JEP 534)</strong> — This one has real numbers behind it. The JVM used to store the mark word and class pointer separately; now they’re merged into a single 64-bit word. A two-int object shrinks from 24 to 16 bytes. SPECjbb2015 shows roughly 22% heap savings, and typical workloads land somewhere in the 10–20% range. No code changes required.</p>
<p><strong>G1 as the default GC everywhere (JEP 523)</strong> — G1 has been the default on most configurations for years, but small containers quietly fell back to Serial GC. That silent fallback is gone. G1 is now the default everywhere, no exceptions.</p>
<p><strong>JFR data redaction</strong> — JFR recordings can capture a lot, including things you don’t want on disk: API keys, passwords, tokens. JFR now redacts those before writing. Worth enabling if you’re running flight recordings in production.</p>
<p><strong>Post-quantum TLS (JEP 527)</strong> — TLS 1.3 gets X25519MLKEM768 hybrid key exchange on by default. This is the ML-KEM (Kyber) post-quantum algorithm layered on top of X25519, so you get quantum resistance without dropping classical security. It’s on by default, which is the right call.</p>
<h2>What’s still in preview or incubator</h2>
<p><strong>Structured Concurrency (7th preview, JEP 533)</strong> — The unchecked <code>FailedException</code> is replaced with a checked <code>ExecutionException</code>, and there’s a new <code>Joiner</code> third type parameter. Seven previews is a long road; the API is clearly still being refined.</p>
<p><strong>Primitive Types in Patterns (5th preview, JEP 532)</strong> — Unchanged from the last round.</p>
<p><strong>Lazy Constants (3rd preview)</strong> — <code>isInitialized()</code> and <code>orElse()</code> are dropped; <code>Set.ofLazy()</code> is added.</p>
<p><strong>PEM Encodings (3rd preview, JEP 538)</strong> — Mostly class renames.</p>
<p><strong>Vector API (12th incubator)</strong> — Still waiting on Project Valhalla value classes before it can finalize. Twelve rounds is a long time to be in incubator.</p>
<h2>Other changes worth noting</h2>
<ul>
<li>ISO-8601 short zone offset parsing added</li>
<li>JVMCI removed</li>
<li><code>-XX:-UseCompressedClassPointers</code> deprecated</li>
</ul>
<h2>JDK 28 is taking shape (March 2027)</h2>
<p>JDK 28 has six JEPs targeted or proposed, with more drafts floating around.</p>
<p><strong>Simple JSON API (JEP 540, incubator)</strong> — A built-in JSON API has been a long time coming. This is the first incubator round, so expect the surface to change.</p>
<p><strong>Value Objects / Value Classes (JEP 401, preview)</strong> — Project Valhalla’s value classes finally get a preview. The short version: value classes have no identity, which lets the JVM flatten them in memory and scalarize them out of existence inside loops. The catch is that Java’s type erasure can reintroduce allocations at megamorphic call sites. One user porting an Elm parsing library to Java hit exactly this: 192 bytes allocated per call, traced back to an erased <code>Object</code>-based descriptor. The fix was redeclaring the typed method signature on the interface. Value classes are primarily a semantic tool — you still need to understand the optimizer to get the performance benefits.</p>
<p><strong>Strict Field Initialization (JEP 539, preview)</strong> — Immutability guarantees that enable flattened, non-atomic memory layouts for value classes. Related to JEP 401.</p>
<p><strong>Generational Shenandoah GC by default</strong> — Shenandoah’s generational mode becomes the default.</p>
<p><strong>macOS/x64 deprecation</strong> — The macOS/x64 port is proposed for deprecation.</p>
<p><strong>Structured Concurrency</strong> — After seven previews in JDK 27, there’s a reasonable chance this finalizes in JDK 28.</p>
<h2>Ecosystem</h2>
<p>Around the same time as the JDK 27 RC, the broader ecosystem saw Spring Boot 4.1.1 and 4.0.8, Spring AI 2.0.1, GraalVM updates, Quarkus, Micrometer Metrics 1.18 and Tracing 1.8 first milestones, and Apache Tika 4.0 GA (with breaking changes). Jakarta EE 12 is also progressing. BellSoft shipped Liberica JDK security patches aligned with Oracle’s August CPU.</p>
<p>The IntelliJ IDEA Conf virtual event runs September 8–9, 2026, a week before JDK 27 ships.</p>


JDK 27 has reached release candidate stage with nine JEPs locked in, targeting GA on September 15, 2026. Key changes include G1 becoming the default garbage collector on all platforms, compact object headers enabled by default (cutting per-object header size from 96 to 64 bits, roughly 10-20% less heap usage), and post-quantum hybrid key exchange (ML-KEM) added to TLS 1.3. Structured Concurrency reaches its seventh preview, Vector API its twelfth incubator round, and JFR gains data redaction. JDK 28, due March 2027, has six JEPs targeted or proposed so far, including deprecation of the macOS/x64 port, a new Simple JSON API incubator, Strict Field Initialization preview, Shenandoah generational mode by default, and a Value Objects preview from Project Valhalla, considered the most consequential item on the list. A few more items, like a fourth Lazy Constants preview and ZGC startup improvements, remain drafts.

Gradle launches agentic initiative and delays Configuration Cache default to Gradle 11

Gradle is launching an initiative called Agentic Gradle, focused on making the build tool work better with AI coding agents: official Gradle skills that teach agents how to run and debug builds, a benchmarking framework to prove which changes actually help agents, and efforts to remove friction like token-wasteful interactions and human-oriented docs. As a tradeoff, the team deprioritized making Configuration Cache the default in Gradle 10, pushing that plan to Gradle 11 instead, while keeping Declarative Gradle and Isolated Projects as ongoing priorities. Configuration Cache remains available today via a manual gradle.properties flag and is recommended for new projects.

Spring AI 2.0.1 ships fixing 80+ issues from the 2.0 GA release

Spring AI 2.0.1 has shipped as the first maintenance release on top of the 2.0.0 GA baseline, fixing over 80 issues reported after teams adopted 2.0. Key upgrade-relevant changes: deprecated Mistral AI chat model constants were removed, the Redis chat memory autoconfiguration module was renamed, OpenAI tool-calling strict mode now defaults to false to fix 400 errors on optional tool parameters, media builders use typed overloads, DeepSeekApi was revised for consistency, and the Couchbase vector store now uses the Spring Boot-managed client. New features include configurable tool call limits with a ToolCallLimitExceededException, configurable tool resolution fallback behavior, Google GenAI ToolChoice support and image generation, and page-range support in PagePdfDocumentReader.

Project Valhalla value classes land in JDK 28 as preview features

<p>A batch of OpenJDK news dropped recently, and there’s enough here to warrant pulling it all together. The headline items: a simple JSON API is now targeted for JDK 28, Valhalla’s value types have actually landed as a preview feature, and Oracle laid out a concrete timeline for backporting post-quantum cryptography to older LTS releases.</p>
<h2>JEP 540: a JSON API that doesn’t try to be Jackson</h2>
<p>JEP 540 moved from Candidate to Proposed to Target for JDK 28 in fairly quick succession. It’s a compact, incubator-module API for parsing, navigating, and generating JSON per RFC 8259 - no external dependencies required.</p>
<p>Worth being clear about what this isn’t. It’s not trying to replace Jackson or Gson. There’s no data binding, no streaming support, no permissive parsing, no syntax extensions. This is meant for the basic stuff - reading a config file, parsing a REST response - not for anything that needs the full weight of a mature JSON library.</p>
<p>The design centers on a sealed <code>JsonValue</code> interface with immutable, thread-safe subtypes. You get direct access methods for traversal, strict rejection of duplicate names (no silently picking the last one), and <code>as...</code>-style conversion methods. It also plays nicely with pattern matching through type-pattern switches, which feels like the right call given where the rest of the language is headed.</p>
<p>One rough edge: constructing JSON values requires explicitly wrapping Java primitives through factory methods. That’s flagged as a likely target for feedback during incubation, so don’t be surprised if this changes shape a bit. If it ships as targeted, you’ll need <code>--add-modules jdk.incubator.json</code> to actually use it.</p>
<h2>Valhalla: value types are real now, not just a promise</h2>
<p>This is the one I’ve been waiting on for years, and it finally happened - JEPs 401 and 539 merged, bringing value types and strict field initialization into JDK 28 early access builds behind <code>--enable-preview</code>. Primitive patterns also got another preview round, unchanged from before.</p>
<p>For context on why this matters: Valhalla exists to align JVM memory layout with how modern hardware actually works. Value classes are composite types without identity - no object header overhead, better cache behavior, the kind of low-level performance work that doesn’t sound exciting until you see the numbers. As of JDK 28 EA, 30 JDK classes have already been migrated over, including the primitive wrapper types, <code>Optional</code>, and the <code>java.time</code> classes.// This is a big deal. Years of design work finally hitting main as something you can actually download and try.</p>
<p>That said, if you want to kick the tires, expect some friction. Tooling hasn’t caught up:</p>
<ul>
<li>Maven 3.9.9 works fine with JDK 28 EA</li>
<li>Gradle 9.7.0 doesn’t support anything past JDK 26 yet</li>
<li>Kotlin’s kapt annotation processor breaks due to changes in javac internals access</li>
<li>Kotlin also chokes on the <code>-ea</code> suffix in version numbers</li>
<li>ASM doesn’t support Java 28 yet, though work is reportedly underway</li>
</ul>
<p>So: real progress, but early-adopter territory. If you’re not comfortable working around broken tooling, maybe wait a release or two.</p>
<h2>Post-quantum crypto is coming to old LTS releases</h2>
<p>JDK 27 will ship hybrid post-quantum TLS 1.3 key exchange next month. More interesting, though, is what Oracle committed to for everything older: comparable PQC capabilities backported to JDK 25, 21, 17, 11, and 8, with a target of end of 2027. That’s a genuinely long tail of support, and it signals Oracle takes the</p>


A roundup of recent OpenJDK news covers three threads: JEP 540, an incubating no-dependency JSON parsing API targeted for JDK 28; Project Valhalla's JEP 401 and JEP 539 merging, bringing value classes and primitive types to JDK 28 early-access builds as a preview; and Oracle's plan to backport post-quantum TLS cryptography to LTS releases 25, 21, 17, 11, and 8 by end of 2027, alongside JDK 27 shipping hybrid PQC TLS 1.3 key exchange next month. Also noted: Oracle shifting security updates from quarterly to monthly cadence by 2027, an out-of-cycle JDK 26.0.1.2 release on August 18th, and an update to the OpenJDK Mail Search tool.

Spring deserialization flaw lets remote attacker terminate JVM via System.exit

A remote denial-of-service vulnerability affects Java deserialization involving nested arrays that can bypass an allowlist, triggering a StackOverflowError. The default JavaLangErrorHandler responds to this error by calling System.exit(99), causing the entire JVM to terminate remotely.

Log4j2 AmqpAppender disables TLS hostname verification by default

The AmqpAppender in Log4j2 disables TLS hostname verification by default, which exposes applications using this appender to man-in-the-middle attacks when sending logs over AMQP with TLS. This is tracked as CVE-2026-59272.

Spring SerializingHttpMessageConverter gets RCE patch for unsafe Java deserialization

A security advisory covers a CVE affecting SerializingHttpMessageConverter in Spring, describing an unsafe Java deserialization flaw that can lead to remote code execution. The page content itself is largely inaccessible, consisting mainly of a cookie consent notice rather than detailed technical remediation steps.

Oracle bans AI-generated code contributions to OpenJDK

Oracle has banned contributing AI-generated content to OpenJDK, covering source code, pull requests, emails, wiki pages, bug reports, text, and images—while still allowing private LLM use for understanding code, debugging, and research. The stated reasons are reviewer workload, safety/security, and IP concerns. The piece compares this to similar policies at Zig (strict no-AI, even for brainstorming), Rust (private use fine, but generated docs/comments banned, generated code allowed only under a disclosed, reviewed experimental process since August 5th), LLVM (AI contributions allowed if a human takes responsibility), and the Linux kernel (AI-generated code and AI-discovered bugs allowed but must be reproduced, tested, and disclosed by a human). The author argues software will split into three tiers—low-stakes slop-codeable projects, customer-facing code needing quality and ownership, and high-leverage systems like kernels, runtimes, and banking infrastructure that demand handcrafted, high-quality code.

Amazon Corretto ships critical security patches for Java 8 through 26

Amazon released critical security patch updates for Corretto, its OpenJDK distribution, covering LTS and Feature Release versions. Updated builds include Corretto 26.0.2.11.1, 25.0.4.8.1, 21.0.12.9.1, 17.0.20.10.1, 11.0.32.10.1, and 8u504, available for download or via Apt, Yum, or Apk repositories on Linux.

Floci open-source multi-cloud emulator launches as LocalStack community edition replacement

Floci is a free, open-source multi-cloud emulator suite built on Quarkus native image, created by Hector Ventura. Unlike mocking or simulation tools, Floci provides true emulation — storing and returning real data — for AWS, Azure, GCP, and Oracle OCI, each running in its own container. Compiled to a GraalVM native image via Quarkus, it achieves 24 ms startup time and 13 MB idle memory. It integrates with Quarkus Dev Services as a drop-in replacement for LocalStack (which archived its community edition shortly after Floci launched). Floci offers four storage modes (memory, persisted, hybrid, write-ahead log) and is increasingly used for AI agent sandboxing, where isolated, disposable cloud environments per agent eliminate risks of LLM operations touching real cloud accounts. Upcoming features include CloudFormation expansion and 'Floci Pods' — portable snapshots of complete environment state for reproducible bug reports.

Databricks open-sources Metals v2 Java and Scala language server for large monorepos

Databricks has open-sourced Metals v2, a Java and Scala language server built to handle multi-million line Bazel monorepos. Originally a Databricks fork of Metals v1, v2 introduces three major architectural changes: a build-free mbt index using Git blob OIDs for fast startup (p50 TTII of 8.7s across a 26M-line codebase), compiler-backed pipelines using the Scala presentation compiler and javac APIs with Turbine for Java symbol loading, and a metadata-first Bazel BSP integration that never invokes Bazel automatically. The result: 92% of Databricks' weekly active IDE users now use Cursor vs. 12% for IntelliJ, and Cursor's share of Scala/Java file opens rose from 40% to 78%. Metals v2 is available in Cursor, VS Code, and Neovim under Apache 2.0, with ongoing development led by VirtusLab. Stripe has also begun rolling it out.

.NET 11 Preview 7 ships IEEE 754 decimal types, NativeAOT CLI default and C# union patterns

<p>C# 15, previewed alongside .NET 11, is shaping up to be one of the more interesting language releases in a while. Two features stand out: a new <code>closed</code> keyword for exhaustive class hierarchies, and nominal union types. Both hit switch-expression exhaustiveness from different angles, and .NET 11 Preview 7 (released August 11, 2026) bundles them with a long list of other changes across <a href="http://ASP.NET" target="_blank" rel="noopener nofollow">ASP.NET</a> Core, MAUI, EF Core, and Windows Forms.</p>
<h2>The <code>closed</code> keyword</h2>
<p>Today, if you write a switch expression over a class hierarchy, the compiler can’t know you’ve covered every case unless you add a discard pattern (<code>_ =&gt; ...</code>). That’s because any assembly could theoretically add a new derived type. Developers have worked around this for years with <code>internal</code> or <code>private protected</code> constructors, but it’s a hack, not a real solution.</p>
<p>The <code>closed</code> keyword lets you mark a base class or record as closed to derivation outside the declaring assembly. Once you do that, the compiler can verify a switch expression is exhaustive without a discard, and it warns immediately if someone adds a new derived class without updating the switch. There are some fiddly edge cases (deriving from a derived class, for instance) but the core idea is straightforward and, frankly, overdue.,</p>
<p>You can try it now in .NET 11 Preview 6 or later by setting <code>LangVersion</code> to <code>preview</code>.</p>
<h2>Union types: promising, but not what F# fans might hope for</h2>
<p>The other big exhaustiveness feature is nominal union types — an <code>IUnion</code>-backed struct that wraps a fixed set of existing types. It’s easy to see this and think</p>


Microsoft released .NET 11 Preview 7, a substantial update ahead of the November general availability. Highlights include tiered compilation for async methods with runtime-async tiering and tail-await optimizations, continued work running CoreCLR inside WebAssembly via a portable interpreter and R2R model, NativeAOT and MSBuild server enabled by default for the dotnet CLI, and new dotnet test options for run-level timeouts and max failed tests. The base class library adds IEEE 754 decimal floating-point types, a generic Complex<T> type, and an HttpContent compression wrapper. C# 15 introduces labeled break/continue for nested loops.