- Netty 4.2.20 and 4.1.140 fix ten advisories, including an mTLS bypass via session resumption
03 November 2026 · Released on 2 November, 4.2.20 lists ten GitHub security advisories and 4.1.140 eight; three are out-of-bounds reads in netty-buffer.
- An open-source MCP server gives coding agents NetBeans' Java refactorings
02 November 2026 · Dukehoff MCP for Java exposes find usages, rename, move, change signature, safe delete and inline over MCP, headless; its authors report 9 turns instead of 51 for a rename across 22 files.
- JetBrains IDEs need their own eMudhra fix; OS updates do not reach them
31 October 2026 · IntelliJ IDEA, the other IDEs, Toolbox, Gateway and ReSharper trust certificates through the bundled JetBrains Runtime, so JetBrains shipped fixed versions; 2025.1 and earlier get none.
- OpenJDK: update Java or remove four roots after the eMudhra key compromise
30 October 2026 · The private keys of eight eMudhra intermediate CAs were recoverable; Java does not check revocation by default, so OpenJDK issued CVE-2026-114820 and published keytool commands for runtimes that cannot be updated yet.
- Amazon Corretto's October 2026 patch covers six Java lines, from 8u512 to 27.0.1
29 October 2026 · Corretto 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33 and 8u512 were released on 26 October; Linux users get them through the Corretto Apt, Yum and Apk repositories.
- JDK 28 preview makes Integer and LocalDate value classes, and unchanged code feels it
28 October 2026 · With preview features enabled, 30 JDK classes lose identity under JEP 401: == compares fields, synchronizing on them fails and WeakHashMap rejects them. The Quality Group asks projects to test both ways.
- JDK 28 pools small off-heap allocations, cutting confined-arena latency up to 90%
26 October 2026 · From JDK 28, small allocations in confined arenas are served from per-thread native-memory pools on Windows, macOS and Linux, with no source changes and the same safety guarantees.
- JEP 546 would let ZGC size the heap itself, targeted for JDK 28
17 October 2026 · The JEP proposes that the Z Garbage Collector adjust heap size automatically to the workload and the host, aiming to match a well-tuned manual configuration while keeping existing sizing flags working.
- JEP 545 targets JDK 28: ZGC starts with a 2MB heap and grows it aggressively
16 October 2026 · Faster Startup and Warmup with ZGC is now Targeted to JDK 28. ZGC would commit 2MB at startup, expand early and concurrently, pre-touch on expansion and use large pages on Linux.
- Payara's October release patches a GlassFish RCE and adds two delete commands
15 October 2026 · Payara Community 7.2026.10 drops the elevated-permission requirement for SSH nodes and adds delete-jvm-option and delete-system-properties; the Azul Payara lines get three security fixes.
- Vaadin Flow 25.3.4 adds development-only routes and backports the push CORS fix
14 October 2026 · Four Flow patches on 13 October carry the Atmosphere CORS fix to the 25.3, 25.1, 24.10 and 24.4 lines; 25.3.4 also adds @Route(developmentOnly = true) and an opt-in Maven compiler for the dev loop.
- Vaadin Flow 25.2.13 stops echoing any Origin on push; 24.x gets the CVE-2026-2742 fix
13 October 2026 · Three Flow patches on 12 October: 25.2.13 turns off Atmosphere's CORS headers for push, 24.7.15 and 24.4.18 stop handling reserved folders like /VAADIN through the index handler, and 24.4.18 raises the minimum Node to 20.
- Hibernate 7.4.13 fixes quoted aliases from HQL subqueries and adds Java 27 support
12 October 2026 · The 11 October patch fixes outer queries that reference a back-tick quoted alias from a derived table, Envers auditing with joined inheritance plus @SecondaryTable, and ByteBuddy on JDK 27.
- Kotlin 2.4.21 fixes JSR-223 eval breaking after Java bindings and a reflection crash
11 October 2026 · The 8 October bug-fix release repairs scripting through javax.script, kotlin-reflect on Java inner classes of generic outer classes, script reruns with transitive dependencies and unminified Kotlin/JS names.
- Oracle's Java extension for VS Code 27.0.0 now needs JDK 21 to run
10 October 2026 · Version 27.0.0 moves to NetBeans 31, adds breakpoints inside individual lambdas and JDK 27 tooling; the extension itself now requires JDK 21 or newer, while projects can still target JDK 8.
- Micronaut 5.2.15, 4.10.31 and 3.10.15 ship this week's Netty fixes
09 October 2026 · Three Micronaut lines released on 7–8 October move their managed Netty to 4.2.19.Final or 4.1.139.Final; 5.2.15 also fixes HTTP 100 Continue handling and fragmented WebSocket messages.
- Gradle 9.8.1 and 8.14.6 fix daemon deserialization and a TLS fall-through
08 October 2026 · Three high-severity advisories published on 7 October: unauthenticated Java deserialization on the worker and client channels of the daemon, and a resolver that moved to the next repository after an SSLException.
- Netty 4.2.19 and 4.1.139 fix 16 security advisories, published without CVE numbers
07 October 2026 · Request smuggling, an SNI routing bypass and several unbounded resource consumption bugs across codec-http, codec-http2, handler and io_uring. The CVE system could not assign numbers in time.
- JEP 542 makes the PEM encoding API final in JDK 28, unchanged after three previews
06 October 2026 · PEMEncoder, PEMDecoder, PEM and the sealed BinaryEncodable interface in java.security leave preview. Reading a key from PEM text no longer needs hand-written parsing and a key factory lookup.
- JDK 28 serves small Arena.ofConfined() allocations from reusable native pools
06 October 2026 · No code changes: allocations up to 64 bytes in a confined arena come from a per-thread pool instead of malloc plus a cleanup action. On an M4 Mac, on a virtual thread, a 5-byte allocation drops from about 15.7 ns to about 3.2 ns.
- JDK 27 turns on compact object headers and makes G1 the default everywhere
05 October 2026 · Oracle's performance round-up for JDK 27: 8-byte object headers by default, G1 even in small containers, and HashMap.putAll from another HashMap up to 86% faster in one benchmark.
- Hibernate 7.4.12: a lambda TupleTransformer no longer needs a matching constructor
04 October 2026 · Since an earlier 7.x change, a query with setTupleTransformer failed with InstantiationException unless the result class had a constructor matching the select list. 7.4.12 fixes that and a Quarkus Data metamodel bug.
- Micronaut 5.2.13 stops @Nullable from erasing a @Bindable default
03 October 2026 · A nullable record component or constructor argument with @Bindable(defaultValue) got null when unconfigured, while the configuration schema advertised the default. 5.2.13 applies the default first.
- Logback 1.6.5 stops trying to clean MDC values and rejects bad ones instead
02 October 2026 · The 1.6.3 fix stripped slashes from MDC values used in SiftingAppender file names and was not enough. CVE-2026-104721: values with .., ${, or other special characters now fall back to a default.
- Maven 3.10.0 binds server credentials to the origins of their repositories
02 October 2026 · A settings.xml server password is now only sent to the scheme, host and port of a repository or mirror declared with the same id. A strict mode refuses everything else.
- Micronaut 5.2.10 stops two beans sharing one circuit breaker through a base class
01 October 2026 · @CircuitBreaker state was keyed by the method, and an inherited method looks the same for every subclass. One bean's open circuit blocked another bean with a different configuration.
- Guava 33.7.2 stops three collections sizing memory by a number from the stream
30 September 2026 · CompactHashMap, CompactHashSet and MapMakerInternalMap trusted a declared size during Java deserialization and allocated for it before reading the data. The fix follows a pattern Guava already used elsewhere.
- Checkstyle 14.3 ships a module-info, 39 minutes after 14.2 fixed checks on new syntax
29 September 2026 · Checkstyle released two versions on 27 September. 14.2.0 carries new checks and a long list of false-positive fixes; 14.3.0 contains one change, an explicit module named com.puppycrawl.tools.checkstyle.
- Hibernate 7.4.11 stops dropping ON CONFLICT DO NOTHING on H2, Oracle and SQL Server
29 September 2026 · An HQL insert-if-absent turned into a plain INSERT on three databases and failed with a unique constraint violation under concurrency. The fix routes it through MERGE; a StatelessSession upsert race is fixed too.
- Micronaut 5.2.9: an HTTP/2 window update that was written but never flushed
28 September 2026 · The patch release fixes a streamed HTTP/2 response that could stall forever under backpressure, stops chunking responses to HTTP/1.0 clients and closes a body leak in request filters.
- jOOQ 3.21.9 fixes an R2DBC cancellation that could poison a connection for good
27 September 2026 · The patch release, published with matching 3.20 and 3.19 updates, closes four R2DBC bugs - a cancelled query, a hanging transaction, lost context in batches and a hidden rollback cause.
- Logback 1.6.4 locks stateful encoders and restores ${...} in the scan attribute
27 September 2026 · The release fixes a regression from 1.5.27 that stopped resolving variables in scan, closes several appender races, fixes a lost-update counter and adds half-day rollover.
- Mockito 5.24 lets @Spy choose its mock maker and prints fields when toString is missing
26 September 2026 · The release also fixes singleton mocks leaking across clearInlineMocks and a NotAMockException with MockitoSession, and corrects its own -javaagent documentation for Gradle.
- Gradle 9.8 can reuse Maven's mirror settings, and the switch is off by default
26 September 2026 · The release adds Java 27 support, one flag to read mirrors from Maven's configuration, and a Groovydoc option that stops modern Java sources from silently vanishing from the docs.
- Quarkus 3.39.5 closes four CVEs, and one of them is in Hibernate ORM
25 September 2026 · SQL injection through an unescaped JSON path segment, a password keyspace reduction via Unicode folding, an unauthenticated SSRF through a JWT kid header, and unbounded WebSocket buffering.
- Spring Security 7.2.0-M2 keeps manifests and DevTools probes out of the RequestCache
25 September 2026 · The milestone modernises the background-request ignore list: Apple touch icons, browserconfig.xml, web app manifests and Chrome DevTools' .well-known probe no longer become the post-login redirect.
- Spring Batch gives the Mongo job repository a collection prefix
24 September 2026 · 6.1.0-M2 adds a configurable prefix defaulting to BATCH_, and rebuilds the default conversion service on Spring's DefaultFormattingConversionService.
- Hibernate's 8.0.0.Beta2 is not flagged as a prerelease
24 September 2026 · The version string says Beta2 and the repository metadata says prerelease: false. Dependency automation reads the flag, not the string.
- The Qute escaping bug was a lost content type, not a missing escape call
23 September 2026 · CVE-2026-93432: Qute's {#eval} section did not pass the parent template's Variant to the sub-template, so HtmlEscaper and JsonEscaper had nothing to decide on and quietly escaped nothing. Patched tags landed the day after the advisory.
- Helidon jumped from version 4 to version 27 to match the JDK
23 September 2026 · Helidon 27.0.0 shipped on 22 September as the first release to fully adopt JEP 14's tip & tail model. It requires Java 27, it is not the LTS — Helidon 4 still is — and Helidon 29 will be.
- The same three CVEs landed again, this time against OpenJDK 21
22 September 2026 · USN-8796-1 patches CVE-2026-61308, CVE-2026-70907 and CVE-2026-60589 in OpenJDK 21 across 26.04, 24.04, 22.04 and 20.04 LTS — the same three identifiers as yesterday's OpenJDK 17 notice, on a different release matrix.
- Three OpenJDK 17 authentication flaws were patched, and you have to restart
22 September 2026 · USN-8795-1 fixes CVE-2026-61308, CVE-2026-70907 and CVE-2026-60589 in Networking, JSSE and Security. The one to remember: the package update does nothing until every running JVM restarts.
- Spring compressed its release train from two weeks to one Thursday a month
21 September 2026 · The whole portfolio now ships on one day, the Thursday after the third Monday. The reason given is the rate of incoming security reports: nearly 80 a month since March.
- Building the JDK on an Intel Mac now fails unless you pass a flag
21 September 2026 · JEP 541 is completed for JDK 28. Oracle stopped maintaining the macOS/x64 port at JDK 27, configure refuses by default, and CI for it is off.
- JDK 28 adds fields that cannot be read before they are written
20 September 2026 · JEP 539 is integrated: a JVM-level opt-in where a field never shows 0 or null, and a final field never shows two values. It is for compilers, not for your source code.
- Synchronizing on a LocalDate throws IdentityException in JDK 28
20 September 2026 · JEP 401 is integrated for JDK 28 as a preview. LocalDate and Integer become value objects, and a few things you could always do to an object stop working.
- JDK 27 brings post-quantum hybrid key exchange to TLS 1.3
19 September 2026 · JEP 527 combines a classical and a post-quantum algorithm, so the connection holds if either survives. PEMEncoder and PEMDecoder are still preview, and one interface got renamed.
- Node.js 26.9.0 adds a built-in benchmark module
19 September 2026 · node:bench arrives in the standard library, the FFI module is on without a flag, and Web Workers land in worker_threads.
- Sitemap lastmod costs four lines and saves crawl budget
19 September 2026 · One tag per URL, and the crawler stops guessing what changed.
- Two sections of a JDK release note decide whether a build breaks
18 September 2026 · A filter for release notes that keeps the two sections that matter.
- Nine declared dependencies resolve to 406 on the classpath
17 September 2026 · Nine direct, four hundred and six transitive. A note on what that costs.
- The JVM stops printing stack traces on repeated exceptions
14 September 2026 · An older note, kept here to show what falls out of the news window.
