This week's Java roundup for April 13th, 2026, features news highlighting: new OpenJDK JEPs; point releases of Apache Grails, Apache Camel and JBang; maintenances of Spring Framework that include resolutions to CVEs; first release candidates of Spring Data and Micrometer Metrics; beta releases of Eclipse Store and Eclipse Serializer; and an update on Jakarta EE 12.
OpenJDK
JEP 534, Compact Object Headers by Default, has been elevated from its JEP Draft 8361187 to Candidate status. This JEP proposes to make JEP 519, Compact Object Headers, delivered in JDK 25, the default object header layout in the HotSpot JVM. More details on Compact Object Headers may be found in this InfoQ news story.
JEP 533, Structured Concurrency (Seventh Preview), has been elevated from its JEP Draft 8373610 to Candidate status. This JEP proposes a seventh preview, with minor changes, after six rounds of preview delivered in JDK 21 through JDK 26 and two rounds of incubator delivered in JDK 19 through JDK 20. This feature simplifies concurrent programming by introducing structured concurrency to "treat groups of related tasks running in different threads as a single unit of work, thereby streamlining error handling and cancellation, improving reliability, and enhancing observability."
JDK 27
Build 18 of the JDK 27 early-access builds was made available this past week featuring updates from Build 17 that include fixes for various issues. Further details on this release may be found in the release notes.
For JDK 27, developers are encouraged to report bugs via the Java Bug Database.
Jakarta EE
In his weekly Hashtag Jakarta EE blog, Ivar Grimstad, Jakarta EE Developer Advocate at the Eclipse Foundation, provided an update on Jakarta EE 12, writing:
The release of Jakarta EE 12 consists of multiple Milestones that are continuously being refined to reflect the current status. In the Platform call last week, the platform project set up expectations for a couple of the milestones. First out is Milestone 4, in which the specifications that are part of Jakarta EE Core Profile are expected to show progress in the form of milestones or beta-releases.
M4: Apr 1 to May 15, 2026
- Jakarta RESTful Web Services 5.0-M1 API/specification
- Jakarta Contexts and Dependency Injection 5.0 Milestone/Beta (currently at Alpha4)
- Jakarta JSON Processing 2.2-M1 API/specification
- Jakarta JSON Binding 3.1-M1 API/specification
M5: May 16 to Jun 30, 2026
- Content to be defined
M6: Jul 1 to Aug 15, 2026
- Content to be defined
M7: Aug 15 to Sep 30, 2026
- Ideally, we release Core Profile here or soon after
M8: Oct 1 to Nov 15, 2026
- Content to be defined
M9: Jan 1 to Feb 15, 2027
- Finalize all other specifications
M10: Feb 16 to Mar 31, 2027
- Release Platform TCK with ratifying implementation
The Platform Project will continue to refine this timeline by adding expectations to each milestone. Note that even if a specification is not listed for a specific milestone, nothing prevents it from publishing ahead of time. If the current plan holds, we should be able to release Jakarta EE Core Profile in Q4, 2026, while Jakarta EE Web Profile and Jakarta EE Platform will be released in Q1 or Q2 next year. This follows the same pattern as for Jakarta EE 11.
Several other specifications are in progress for a milestone 2 release for Jakarta EE 12. These include: Jakarta Connectors 3.0; Jakarta Faces 5.0; Jakarta Transactions 2.1; and Jakarta JSON Processing 2.2.
Spring Framework
The release of Spring Framework 7.0.7 and 6.2.18 delivers bug fixes, documentation improvements, dependency upgrades and new features such as: improved introspection performance in the SpringValidatorAdapter and MethodValidatorAdapter classes by pre-identifying binding failures; and a new RestClientXhrTransport class as a RestClient based variant of the RestTemplateXhrTransport class.
These releases also address three CVEs related to Spring MVC and WebFlux:
- CVE-2026-22740, Spring Framework DoS with Multipart Temp Files in WebFlux, a vulnerability that allows an attacker to consume available disk space due to temporary files that may remain undeleted after multipart requests are fully processed.
- CVE-2026-22741, Static Resource Cache Poisoning in Spring MVC and WebFlux, a vulnerability that allows an attacker to send malicious requests, under certain conditions, and poison the resource cache with resources using the wrong encoding causing a Denial of Service by breaking the front-end application for clients.
- CVE-2026-22745, Denial of Service in Static Resource Handling on Windows Platforms, a vulnerability that allows an attacker to send malicious requests, under certain conditions, that are slow to resolve and that can keep HTTP connections in use causing a Denial of Service on the application.
More details on these releases may be found in the release notes for version 7.0.7 and version 6.2.18.
The first release candidate of Spring Data 2026.0.0 ships with bug fixes, dependency upgrades and new features such as: a new RedisMessageSendingTemplate class that provides a message sending template, based on the Spring Framework MessageSendingOperations interface with a configurable MessageConverter, that complements annotation-based publish/subscribe listeners; and a new ResetStrategy interface to support cache resets and optimizations when using Redis. Further details on this release may be found in the release notes.
Grails
The release of Apache Grails 7.1.0 provides notable changes such as: a new <g:flashMessages /> tag that renders ${flash.message}, ${flash.error} and ${flash.warning} templates as dismissible Bootstrap alert <div> tags with the appropriate styling; and support for a context path added in their Geb integration for improved test writing in a multiproject environment. More details on this release may be found in the release notes.
Micrometer
The first release candidate of Micrometer Metrics 1.17.0 delivers bug fixes, dependency upgrades and new features such as: a new gauge metric, executor.delayed, for the getDelayedTaskCount() method, added to the Java ForkJoinPool class in JDK 25, to align with the metric for the getQueuedTaskCount() method in the same class; and a new function counter metric for the new getTotalGcCpuTime() method, added to the Java MemoryMXBean interface in JDK 26, that counts cumulative CPU time on GC activity. Further details on this release may be found in the release notes.
Eclipse Store/Serializer
The first beta release of Eclipse Store and Eclipse Serializer 4.1.0 ships with bug fixes and new features such as: a new BatchStorer interface to efficiently manage batched persistence operations; and enhancements to the root() and setRoot() methods, defined in the StorageManager interface, to support generic typing. More details on this release may be found in the release notes for Store 4.1.0-beta1 and Serializer 4.1.0-beta1.
Apache Camel
The release of Apache Camel 4.19.0 provides bug fixes, dependency upgrades and new features such as: new Camel components that include Azure Functions, Groovy JSON and Spring AI Image; improvements to the PQC Algorithms component that now support hybrid cryptography, key lifecycle management and platform-wide quantum-safe TLS readiness; and support for Spring Boot 4.0 in Camel Spring Boot. Further details on this release may be found in the release notes and this blog post.
JBang
The release of JBang 0.138.0 delivers bug fixes, documentation improvements and one new feature that enables JBang to execute WAR files with the same capabilities as JAR files. Use of the deprecated isJar() method, defined in the Project class, has been maintained for backwards compatibility. More details on this release may be found in the release notes.