--- title: "GraalVM moves to monthly releases, Quarkus patches a severe CVE" url: https://daily.dev/posts/graalvm-moves-to-monthly-releases-quarkus-patches-a-severe-cve-d1pphcvlw source_url: https://daily.dev/posts/graalvm-moves-to-monthly-releases-quarkus-patches-a-severe-cve-d1pphcvlw type: freeform source: "Java Digest" published: 2026-05-11T04:17:47.458Z updated: 2026-05-11T04:18:18.316Z tags: ["java", "spring-boot", "quarkus", "jdk"] reading_time: 4 upvotes: 4 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GraalVM moves to monthly releases, Quarkus patches a severe CVE **[Java Digest](https://daily.dev/sources/java_digest)** · 4 min read · 4 upvotes · 0 comments ## Summary A roundup of major Java ecosystem news: GraalVM is switching to monthly feature releases starting May 2026 with version 25.1, skipping JDK 26–28 to align with Java 29 LTS. Quarkus issued emergency patches for a severe CVE across all supported streams — upgrade immediately. JDK 27 is taking shape with Structured Concurrency, Lazy Constants, Primitive Types in Patterns, and a new post-mortem JVM crash analysis tool. Microsoft's GitHub Copilot Modernize 101 series demonstrated AI-assisted Java migration, including a Java 5/Struts 1.3 codebase migrated to Java 21 and Spring Boot in roughly two days (vs. an estimated 14 weeks manually), with the caveat that human strategy work was still essential. Also covered: Spring AI 2.0.0-M6, Quarkus 3.35 with 52% faster startup, Java 26 with HTTP/3 support, Hibernate Tools consolidation, IntelliJ IDEA 2025.3.5 performance fix, Apache Flink 1.20.4, and more. ## Content **TLDR:** GraalVM is dropping its six-month release cadence in favor of monthly feature releases starting with 25.1 in May 2026. Quarkus pushed emergency patches across all supported streams for a severe CVE this week. JDK 27 is shaping up fast, with Structured Concurrency, Lazy Constants, and Primitive Types in Patterns all retargeted. Microsoft's GitHub Copilot modernization series showed a Java 5/Struts 1.3 codebase migrated to Java 21 and Spring Boot in roughly two days. --- ## GraalVM switches to monthly releases GraalVM is moving to a monthly feature release train starting with version 25.1 in May 2026, replacing the previous six-month cadence for Community Edition. Oracle GraalVM 25.0 stays on the stable LTS track with quarterly Critical Patch Updates. Upcoming work includes Native Image Layers for container efficiency, Native Image Crema for dynamic class loading, and a Web Image target for WebAssembly. GraalVM will skip JDK 26–28 and align with Java 29 LTS instead. ## Quarkus CVE-2026-39852 emergency patches Quarkus published emergency releases across all supported streams to address a severe security vulnerability. Fixed versions are 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.34.7, and 3.35.2. If you're running any supported Quarkus stream, upgrade now — there's no reason to wait on this one. ## JDK 27 takes shape Several JEPs were retargeted to JDK 27 this week: Structured Concurrency (7th preview), Lazy Constants (3rd preview), Primitive Types in Patterns (5th preview), and JEP 528 for post-mortem JVM crash analysis via jcmd. The crash analysis feature is particularly interesting — it introduces a revival helper process that loads the crashed JVM binary into the same virtual address space to reconstruct state and run diagnostic commands against core files. Targets Linux x64/aarch64 and Windows x64. ## AI-assisted Java modernization: real numbers Microsoft's 9-part GitHub Copilot Modernize 101 series put some concrete figures on AI-assisted migration. One demo upgraded a Spring Boot 1.5.9/Java 8 app to Spring Boot 3.5.3 and Java 25 in about 20 minutes using OpenRewrite under the hood. A more striking example: a Java 5/Struts 1.3 codebase that would have taken an estimated 14 weeks manually was migrated to Java 21 and Spring Boot in roughly two days. The caveats matter — the developer still had to write the migration plan, build verification tooling, and craft explicit agent instructions. The AI handled mechanical execution; the strategy work was still human. --- ## Also notable - **Spring AI 2.0.0-M6** ships with ChatModel API improvements; M5 earlier in the week added structured output refinements. - **Quarkus 3.35** adds build-time JAR tree-shaking, PGO for native builds, and automatic OpenJ9 Shared Classes Cache support on IBM Semeru — benchmarks show 52% faster startup, hitting 206ms for a REST JSON app. - **Quarkus Agent MCP** is a standalone MCP server wrapping `quarkus dev` that gives AI coding agents like Claude Code and Cursor deep Quarkus-specific context, including log access, exception inspection, and extension-level skill files via `META-INF/quarkus-skill.md`. - **Netflix Nebula ArchRules** is a Gradle plugin that scales ArchUnit across tens of thousands of repos; Netflix is currently running 358 rules detecting nearly 1 million issues, with OpenRewrite auto-remediation planned. - **Hibernate Tools consolidation** — starting with Hibernate ORM 7.4, Hibernate Tools core modules merge into the ORM repo; group ID changes from `org.hibernate.tool` to `org.hibernate.orm`, and Eclipse-based tooling is effectively archived. - **IntelliJ IDEA 2025.3.5** patches a specific performance regression where Spring bean declaration searches were firing during typing and code completion. - **Java 26** is out with HTTP/3 support in HttpClient (JEP 517), JVM warnings for reflection-based final field mutation (JEP 500), and the Applet API finally removed after nine years (JEP 504). - **JobRunr 8.6.0** adds JDK 26 compatibility; the team also launched ClawRunr, an open-source Java AI agent for scheduled and recurring background tasks with MCP tool support and browser automation. - **Apache Flink 1.20.4** fixes 41 bugs including wrong results from STDDEV/VAR with FILTER conditions and Flink WebUI breakage in Chrome 144+. - **GlassFish 9.0.0-M2** targets Jakarta EE 12 with Jakarta REST and Authorization integration; GlassFish 8.0.2 also received a maintenance update. - **Micronaut 5.0.0-M3** is out and targeting JDK 25; the team is asking for community testing before GA. - **Apache Geode 2.0** completed a major modernization: JDK 8 to 17, Jakarta EE 10, Spring Framework 6, Spring Shell 3.x — 800+ changed files, 18,000+ lines added, all 10,600+ tests passing. - **`Collections.unmodifiableList()`** is a wrapper, not a copy — mutations to the backing list are visible through it. Use `List.of()` or copy first if you need true immutability. - **Azul Zulu** is now a Docker Official Image; a jlink-based custom runtime image gets a Spring Boot app down to 141 MB versus 568 MB for a naive single-stage build. ## Similar posts on daily.dev - [Java News Roundup: GraalVM, Spring AI, JobRunr, GlassFish, Grails, Groovy, Quarkus Agent MCP](https://daily.dev/posts/java-news-roundup-graalvm-spring-ai-jobrunr-glassfish-grails-groovy-quarkus-agent-mcp-slhikd0rf) · InfoQ · 8 upvotes · 0 comments - [Java News Roundup: JDK 25-RC2, Eclipse JNoSQL, Quarkus, Apache TomEE, Apache Camel](https://daily.dev/posts/java-news-roundup-jdk-25-rc2-eclipse-jnosql-quarkus-apache-tomee-apache-camel-2l3rhkc06) · InfoQ · 1 upvotes · 0 comments --- Tags: [#java](https://daily.dev/tags/java), [#spring-boot](https://daily.dev/tags/spring-boot), [#quarkus](https://daily.dev/tags/quarkus), [#jdk](https://daily.dev/tags/jdk) [View this post on daily.dev](https://daily.dev/posts/graalvm-moves-to-monthly-releases-quarkus-patches-a-severe-cve-d1pphcvlw)