JDK planning and garbage collection
The most notable OpenJDK update is that JEP 535, “Shenandoah Garbage Collector: Generational Mode by Default,” has moved from Proposed to Target to Targeted and is planned for JDK 28. The proposal makes generational mode the default for Shenandoah, a low-pause garbage collector. In practical terms, a generational collector separates objects by expected lifetime, which can improve efficiency because many objects die young. The non-generational mode is set to be deprecated and removed in a future release.
Early-access builds also continue to move forward. JDK 27 Build 34 upgrades from Build 33 with assorted fixes, while JDK 28 Build 10 upgrades from Build 9. Oracle Java Platform Group chief architect Mark Reinhold also announced a schedule change for JDK 27: the first release candidate is now planned for August 20, 2026, instead of August 6, 2026. The change aligns with the next Critical Patch Update on August 18, 2026. Reinhold noted that the feedback window for the RC will shrink from five weeks and four days to three weeks and four days, but said historical data since the six-month release cadence suggests the added risk is acceptable.
Security updates for servers and CI
GlassFish 8.0.4 delivers bug fixes, documentation improvements, dependency upgrades, and new functionality. Improvements to AutoDeployer and FileArchive add protection against files leaking from archives. The release also fixes CVE-2026-59889 and CVE-2026-54515, both related to Jackson Databind deserialization. A more severe issue, CVE-2026-12605, could allow an attacker to take over a GlassFish domain without authentication before an exposed gfresttoken expires.
JetBrains issued further guidance for TeamCity CVE-2026-63077. The vulnerability allows an attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and execute arbitrary operating-system commands. There have been reports of active exploitation and exploitation attempts against unpatched servers. Users are strongly advised to upgrade to TeamCity 2025.11.7 or 2026.1.3; if that is not possible, TeamCity 2017.1 and later should apply the security patch plugin.
AI integration reaches Java libraries and integration frameworks
A2A Java SDK 1.2.0 has been released. The SDK implements the Agent2Agent protocol and lets agentic applications run as A2A servers. The release includes fixes, dependency upgrades, support for non-CDI integrations to reuse existing authorization flows, and a new TaskStreamLifecycleHook for observing task-stream lifecycle events. A StreamCloseHandle interface enables closing all ChildQueue instances for a task inside EventQueue.
Apache Camel 4.22.0 focuses on AI integration as well. Camel is an enterprise integration framework for connecting systems, protocols, and data flows through routes. The release introduces camel-ai-tool, a tool that AI frameworks can discover, and camel-mcp-server, which allows developers to expose Camel routes as MCP tools discoverable and callable by compatible MCP clients.
Framework and build-tool progress
Apache Grails 8.0.0 milestone 5 adds bug fixes, dependency upgrades, and internal refactoring. GlobalGrailsClassInjectorTransformation has been reworked to extract helper methods, plugin.xml handling has been expanded, and isolated build behavior has been implemented. GrailsUtil.deepSanitize() now recognizes values supplied through grails.logging.stackTraceFiltererClass and grails.exceptionresolver.logFullStackTraceOnFilter.
Gradle 9.7.0 promotes the performance feature of Isolated Projects from experimental to incubating. It also improves Configuration Cache, which reuses cached configuration-phase results in later builds to reduce build time. Security and infrastructure updates make it easier to document trusted PGP keys and discover signing-key rotations.
Outlook
The week’s Java news points to three parallel trends: runtime performance, supply-chain and server security, and AI-facing integration. Shenandoah’s generational default shows continued investment in predictable, low-pause JVM behavior. The TeamCity and GlassFish fixes underline the need for fast patch management, especially where remote access and administrative control are involved. Meanwhile, A2A Java SDK and Camel’s MCP-related additions show Java positioning itself as a strong enterprise integration layer for agentic applications. In the near term, security upgrades should take priority; over time, GC defaults, build acceleration, and AI tool discovery will shape how Java systems are built and operated.