Upgrades that change behaviour, not just version numbers

A version bump is supposed to be boring. These notes are the cases where it was not: a release note whose two quiet sections decide whether your build still works, a TLS handshake that changes shape underneath you, a runtime that grows a built-in benchmark and an FFI, a threading model that turns a familiar keyword into a performance cliff. The upgrade is not the risk - the behaviour nobody read about is.

• JDK 27 brings post-quantum hybrid key exchange to TLS 1.3
  19 September 2026 · JEP 527 combines a classical and a post-quantum algorithm, so the connection holds if either survives. PEMEncoder and PEMDecoder are still preview, and one interface got renamed.
• Node.js 26.9.0 adds a built-in benchmark module and enables FFI by default
  19 September 2026 · node:bench arrives in the standard library, the FFI module is on without a flag, and Web Workers land in worker_threads.
• Two sections of a JDK release note can break a build. The rest is optional
  18 September 2026 · A filter for release notes that keeps the two sections that matter.
• Virtual threads pin the carrier inside synchronized, and one flag finds it
  12 September 2026 · Why your virtual threads are not scaling, and the flag that tells you.