--- title: Java 26 ships HTTP/3 and AOT improvements, Endive 1.0... description: Java 26 is released with HTTP/3 support via QUIC in the HTTP Client API, AOT object caching extended to ZGC, and restrictions on reflective modification of... canonical: https://daily.dev/posts/java-26-ships-http-3-and-aot-improvements-endive-1-0-brings-wasm-to-the-jvm-4wspepe9h twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Java 26 ships HTTP/3 and AOT improvements, Endive 1.0 brings Wasm to the JVM | daily.dev og:description: Java 26 is released with HTTP/3 support via QUIC in the HTTP Client API, AOT object caching extended to ZGC, and restrictions on reflective modification of... og:url: https://daily.dev/posts/java-26-ships-http-3-and-aot-improvements-endive-1-0-brings-wasm-to-the-jvm-4wspepe9h og:image: https://api.daily.dev/og/posts/4wSpepE9H.png og:image:alt: Java 26 ships HTTP/3 and AOT improvements, Endive 1.0 brings Wasm to the JVM og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Java 26 ships HTTP/3 and AOT improvements, Endive 1.0 brings Wasm to the JVM **[Java Digest](https://daily.dev/sources/java_digest)** · 4 min read · 2 upvotes · 0 comments ## Summary Java 26 is released with HTTP/3 support via QUIC in the HTTP Client API, AOT object caching extended to ZGC, and restrictions on reflective modification of final fields. Endive 1.0 (formerly Chicory), a pure-Java WebAssembly runtime under the Bytecode Alliance, ships with full WasmGC spec support enabling Kotlin/Wasm and Dart to run on the JVM with native GC integration. Chainguard launches drop-in CVE remediation for Spring Boot libraries, targeting end-of-life versions like Spring Boot 2.7 which carries 143 unpatched CVEs. Quarkus 3.37 bumps Hibernate ORM to 7.4 and enables reflection-free Jackson serializers by default. Additional items cover Hibernate 7.2's @EmbeddedTable, StepSecurity Maven supply chain protections, a new zero-dependency JVM Parquet reader, a TLS version gotcha in SSLContext, and Spring Boot 4.1's MongoDB-backed Batch JobRepository. ## Content **TLDR:** Java 26 is out with HTTP/3 support in the HTTP Client, AOT object caching extended to ZGC, and restrictions on reflective modification of final fields. Endive 1.0 (formerly Chicory) ships under the Bytecode Alliance with full WasmGC spec support, letting Kotlin/Wasm and Dart run on the JVM with native GC integration. Chainguard launched CVE remediation for Spring Boot libraries, giving teams a drop-in path for end-of-life frameworks like Spring Boot 2.7 which carries 143 unpatched CVEs. Quarkus 3.37 bumps Hibernate ORM to 7.4 and enables Jackson reflection-free serializers by default. --- ## Java 26 released with HTTP/3, ZGC AOT caching, and final field encapsulation Java 26 lands HTTP/3 support in the HTTP Client API via QUIC, extends AOT object caching to work with any GC including ZGC, and restricts reflective modification of final fields — a meaningful encapsulation tightening that could break code relying on that pattern. The Applet API is finally gone. Also in this release: G1 GC throughput improvements reducing thread synchronization overhead, a second preview of PEM encoding APIs, and a fourth preview extending pattern matching to primitive types in instanceof and switch. The Vector API hits its eleventh incubator, which at this point is its own kind of milestone. [Read more](https://daily.dev/posts/x8PP9Vbj4) ## Endive 1.0 ships under Bytecode Alliance with full WasmGC support Endive 1.0, the pure-Java WebAssembly runtime formerly known as Chicory, is now on Maven Central under the Bytecode Alliance. The headline addition is full WasmGC spec support, which means Kotlin/Wasm, Dart, and other GC-managed languages can run on the JVM with native JVM GC integration — no separate GC to manage. Tail-call optimization is in for CPython 3.14-based workloads. Migration from Chicory is a find-and-replace of Maven coordinates. Component Model support and Cranelift-based native compilation are next on the roadmap. [Read more](https://daily.dev/posts/mbjstf9ZZ) ## Chainguard launches drop-in CVE remediation for Spring Boot ecosystem Chainguard now offers generally available CVE remediation for Java libraries, starting with Spring Boot. Teams swap a single pom.xml reference to get a Chainguard-remediated version with a -0.cgr.N suffix that scans clean in Wiz, AWS Inspector, Grype, and Trivy. The target is the end-of-life backlog — Spring Boot 2.7 alone carries 143 unpatched CVEs. Each package ships with an SBOM and provenance attestation. This is a fourth option beyond security exceptions, DIY backports, or a disruptive upgrade, which is genuinely useful for teams stuck on old versions in regulated environments. [Read more](https://daily.dev/posts/7UdXJrDQ5) ## Quarkus 3.37 bumps Hibernate ORM to 7.4, enables reflection-free Jackson serializers Quarkus 3.37 ships Hibernate ORM 7.4 with behavioral changes worth reviewing before upgrading: SQL-level pagination limits, new NOT NULL constraints on timestamp columns, and a PostgreSQL 14 minimum. Jackson reflection-free serializers are now on by default, which improves serialization performance but could surface issues in codebases with unusual Jackson configurations. A new experimental quarkus-jlink extension produces custom runtime images with only required JDK modules, reducing container image sizes. Hibernate Reactive moves to 3.4 and Hibernate Search to 8.4. [Read more](https://daily.dev/posts/AxuVjuezI) --- ## Also notable - **Hibernate 7.2 adds @EmbeddedTable and native regex operator in HQL:** Hibernate 7.2 introduces @EmbeddedTable to map embeddable objects to secondary tables with a single annotation instead of per-field @AttributeOverride chains, and a native `like regexp` operator in HQL that translates to each database's native regex function — though regex flavor still depends on the underlying engine. [Read more](https://daily.dev/feed-by-ids?id=MNFa0ujFY&id=3X31UtXV3) - **StepSecurity adds Maven supply chain protections including compromised-package blocking:** StepSecurity now supports Maven in its GitHub Checks with two controls: Maven Package Compromised Updates blocks PRs introducing flagged dependencies, and Maven Package Cooldown holds newly published Maven versions for a configurable waiting period — motivated by real incidents including the Shai-Hulud worm spreading to Maven Central. [Read more](https://daily.dev/posts/W2HG7p3FK) - **Hardwood 1.0: zero-dependency JVM Parquet reader hitting 16.5M rows/sec on 8 vCPUs:** Hardwood 1.0 is a new Apache Parquet reader for Java 21+ with no mandatory dependencies, using virtual threads for multi-threaded page decoding and benchmarking at 16.5M rows/sec versus parquet-java's single-threaded approach; write support is planned for 1.1. [Read more](https://daily.dev/posts/JVWdcp24U) - **Java's SSLContext.getInstance() with a version string caps TLS at that version, not floors it:** Calling SSLContext.getInstance("TLSv1.2") sets a maximum TLS version, not a minimum — silently preventing TLS 1.3 negotiation — affecting both SunJSSE and Android's Conscrypt; the fix is to use "TLS" instead. [Read more](https://daily.dev/posts/EdkiIHBlA) - **Spring Boot 4.1 adds MongoDB-backed Spring Batch JobRepository:** Spring Boot 4.1 ships spring-boot-starter-batch-data-mongodb, letting Spring Batch store job and step execution metadata in MongoDB instead of requiring a relational database — MongoDB replica set is required for transaction support. [Read more](https://daily.dev/posts/T6xiEyuoM) ## Similar posts on daily.dev - [Endive 1.0 Is Here: Wasm on the JVM Ships Under the Bytecode Alliance](https://daily.dev/posts/endive-1-0-is-here-wasm-on-the-jvm-ships-under-the-bytecode-alliance-mbjstf9zz) · Foojay.io · 1 upvotes · 0 comments - [WebAssembly on the JVM: Feature Evolution, Performance, and the Transition to Endive](https://daily.dev/posts/webassembly-on-the-jvm-feature-evolution-performance-and-the-transition-to-endive-ojqefrjid) · InfoQ · 4 upvotes · 0 comments - [foojay – a place for friends of OpenJDK](https://daily.dev/posts/foojay-a-place-for-friends-of-openjdk-zngoj4bsc) · Foojay.io · 1 upvotes · 1 comments --- Tags: [#java](https://daily.dev/tags/java), [#spring-boot](https://daily.dev/tags/spring-boot), [#webassembly](https://daily.dev/tags/webassembly), [#quarkus](https://daily.dev/tags/quarkus) [View this post on daily.dev](https://daily.dev/posts/java-26-ships-http-3-and-aot-improvements-endive-1-0-brings-wasm-to-the-jvm-4wspepe9h) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/java-26-ships-http-3-and-aot-improvements-endive-1-0-brings-wasm-to-the-jvm-4wspepe9h","headline":"Java 26 ships HTTP/3 and AOT improvements, Endive 1.0 brings Wasm to the JVM","text":"Java 26 is released with HTTP/3 support via QUIC in the HTTP Client API, AOT object caching extended to ZGC, and restrictions on reflective modification of final fields. Endive 1.0 (formerly Chicory), a pure-Java WebAssembly runtime under the Bytecode Alliance, ships with full WasmGC spec support enabling Kotlin/Wasm and Dart to run on the JVM with native GC integration. Chainguard launches drop-in CVE remediation for Spring Boot libraries, targeting end-of-life versions like Spring Boot 2.7 which carries 143 unpatched CVEs. Quarkus 3.37 bumps Hibernate ORM to 7.4 and enables reflection-free Jackson serializers by default. Additional items cover Hibernate 7.2's @EmbeddedTable, StepSecurity Maven supply chain protections, a new zero-dependency JVM Parquet reader, a TLS version gotcha in SSLContext, and Spring Boot 4.1's MongoDB-backed Batch JobRepository.","url":"https://daily.dev/posts/java-26-ships-http-3-and-aot-improvements-endive-1-0-brings-wasm-to-the-jvm-4wspepe9h","datePublished":"2026-06-29T04:17:56.691Z","dateModified":"2026-06-29T04:18:24.791Z","author":{"@type":"Organization","name":"Java Digest","logo":"https://media.daily.dev/image/upload/s---g5D7hJ2--/f_auto,q_auto/v1773839415/logos/java_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/java_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/java_digest","name":"Java Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Java Digest","item":"https://daily.dev/sources/java_digest"},{"@type":"ListItem","position":3,"name":"Java 26 ships HTTP/3 and AOT improvements, Endive 1.0 brings Wasm to the JVM"}]} ```