Java
Java Ecosystem Advances: GraalVM Security Hardening, Jakarta Data Updates, and New AI Orchestration Tools
Major Java releases this week bring cryptographic improvements to JDK 28, enhanced Jakarta specifications for data and NoSQL, and new capabilities for AI-driven workflows on the JVM.
InfoQ
Java's development ecosystem moved forward this week with a range of releases spanning runtime enhancements, enterprise middleware updates, and emerging AI integration patterns. The updates span both core platform development and higher-level frameworks, addressing security, performance, and modern development needs.
OpenJDK and Future Releases#
The Java community advanced work toward JDK 28 with JEP 542 receiving its targeted status for that version. This enhancement introduces standardized support for encoding and decoding cryptographic objects—keys, certificates, and certificate revocation lists—in the widely-used Privacy-Enhanced Mail (PEM) format. The feature finalizes a three-release preview cycle running through JDK 27, introducing class reclassifications and interface renames (such as the shift to DEREncodable) to align with the actual binary formats being handled.
Development builds continued advancing: JDK 27 Build 35 and JDK 28 Build 13 became available, with the latter including numerous bug fixes accessible through the OpenJDK issue tracker.
Enterprise Middleware and Cloud Deployment#
GraalVM 25.3 strengthened its performance and security profile with a new priority inliner class boosting code generation efficiency in both JIT and Native Image modes, alongside hardening mechanisms designed to block execution redirects that attackers might exploit.
On the enterprise application server front, WildFly 41.0.1 shipped with updates to serialization filtering per JEP 290 and an upgraded Apache CXF that blocks decoupled web service destinations to mitigate Server-Side Request Forgery risks. Open Liberty 26.0.0.9 (beta) integrated the MCP Java API, though developers must adjust JMX monitoring queries to accommodate revised ObjectName keys.
Azul Payara 7.3.0 arrived with consistent gRPC 1.83.1 support across all release trains, enhanced access log filtering, and notably, the initial implementation of the Jakarta Agentic AI specification—signaling enterprise Java's pivot toward integrated AI agent frameworks.
GlassFish rounded out the application server updates with new Docker images for version 8.0.4, complete with embedded variants and user documentation.
