Oracle’s JDK 27 reached general availability this week, bringing nine Java Enhancement Proposals (JEPs) spanning post-quantum cryptography and language innovation. The September 2026 release cycle also saw Netflix launch its new ja command-line tool, alongside major updates to Open J Proxy, Azul Payara, and BoxLang.
JDK 27 Ships With Nine JEPs and Post-Quantum Prep
Java developers gained several major platform releases this week, led by Oracle’s official rollout of JDK 27. The production-ready release incorporates nine distinct JEPs designed to future-proof enterprise runtimes, notably introducing foundational capabilities for post-quantum cryptography. BellSoft moved quickly to match Oracle’s cadence, releasing LibericaJDK 27 as a downstream OpenJDK distribution. BellSoft contributed three of the 2,542 total fixes merged from the OpenJDK and JavaFX repositories for this cycle.
https://x.com/jhipster/status/2100795037663810020
Concurrently, early-access engineering for the next release cycle is already accelerating. JDK 28 early-access builds are underway, with Build 16 dropping this week carrying code fixes rolled over from Build 15.
Netflix Introduces the ja CLI and Open J Proxy Hits 1.0
Netflix expanded its developer tooling portfolio by releasing ja, a brand-new command-line utility built directly on top of the Java Module System (JMS). The utility is engineered to give developers a streamlined CLI experience for module resolution, source-aware symbol search, and browsable API documentation. According to release documentation, Netflix designed ja so traditional applications can gradually evolve into modular Java Module System applications without forcing teams to adopt an overly complex build system.
Meanwhile, Open J Proxy crossed a major milestone by hitting its 1.0.0 General Availability release alongside two release candidates. The open-source JDBC proxy driver adds a localized cache for immutable DatabaseMetaData and ResultSetMetaData classes to trim down network overhead and improve query performance. Enterprise architects running Kubernetes clusters will note that Open J Proxy introduced configurable leak detection for HikariCP connection pools through the new ojp.connection.pool.leakDetectionThreshold property. The project’s engineering team previously partnered with OmniFish back in January to specifically target database scaling bottlenecks in cloud-native deployments.
Framework Patches: Azul Payara, BoxLang, and JHipster
Enterprise application servers saw critical security and architectural updates this week. Azul Payara rolled out its September 2026 release stream—spanning Community Edition 7.2026.9, Enterprise Edition 6.42.0, and Enterprise Edition 5.91.0. All three tiers patch CVE-2026-68497, a Jackson Databind vulnerability that allows unauthenticated actors to submit multi-megabyte payloads designed to force prolonged, single-threaded CPU consumption and exhaust worker thread pools. Payara’s update also adds native support for MicroProfile 7.1 and the Jakarta Agentic AI specification within Payara Micro and Embedded, while formally deprecating MicroProfile OpenTracing in favor of OpenTelemetry’s @WithSpan annotation.
Other ecosystem frameworks implemented sweeping structural changes:
- BoxLang 1.17.0: Introduced a new
ModuleServiceclass supporting nested modules, a fast check action command to parse source code without full bytecode compilation, and built-in encryption for sensitive configuration values stored insideboxlang.jsonandApplication.bxfiles. - JHipster 9.4.0: Swapped out Cypress in favor of Playwright for end-to-end testing suites, while completely reimplementing R2DBC repositories on Spring Data R2DBC using the JHipster Framework CriteriaBuilder.
- Ktor 3.6.0: JetBrains streamlined OAuth2 setup by adding an OpenID Connect plugin that features automatic configuration discovery to eliminate boilerplate code.
A2A Jakarta SDK and the Jakarta EE 12 Horizon
Integration tooling also advanced with WildFly releasing version 1.0.0.Final of its A2A Java SDK for Jakarta Servers. The SDK tightly couples the A2A protocol with Jakarta RESTful Web Services, porting authorization tests from the base A2A Java SDK and shifting multiversion routing logic over to the @PreMatching annotation powered by CDI-discovered A2AVersionProvider instances.
Looking ahead at the enterprise Java horizon, Ivar Grimstad, Jakarta EE Developer Advocate at the Eclipse Foundation, outlined the structural timeline for Jakarta EE 12. The Core Profile specification is slated to ship in December 2026, with the Web Profile and full Platform specifications following in Q1 and Q2 of 2027. Community members are also anticipating an upcoming vote to officially bundle Jakarta NoSQL 1.1 into the Jakarta EE 12 release train.
