A roundup of OpenJDK developments covers Project Valhalla's value types and primitive patterns landing in JDK 28 early access builds, JEP 540 proposing a simple incubating JSON parsing API targeting JDK 28, and post-quantum cryptography progress: JDK 27 adds hybrid post-quantum TLS 1.3 key exchange next month, while Oracle's July 2026 cryptographic roadmap update commits to backporting comparable PQC capabilities to JDK 25, 21, 17, 11, and 8 by end of 2027. Also covered: Oracle's plan to shift Java security updates from quarterly to monthly cadence starting in earnest in 2027, an out-of-cycle JDK 26.0.1.2 release on August 18th, and an updated OpenJDK Mail Search tool.
Questions this post answers
What does JEP 540's incubating JSON API in JDK 28 actually let you do?
JEP 540 proposes an incubating simple JSON parsing and printing API, centered on the sealed interface JsonValue with six specialized subtypes for objects, arrays, strings, numbers, booleans, and null. You call Json.parse on a string and chain methods like get("users").get(0).get("name"), or use asMap()/asList()/tryGet() for safer exploration. It requires compiling and running with --add-modules jdk.incubator.json and has no data binding or streaming, so it isn't meant to replace Jackson or GSON. Track JDK 28 incubating features like the JSON API as they move toward release on daily.dev.
Which older JDK versions will get post-quantum cryptography support and by when?
Oracle's July 2026 cryptographic roadmap update states that Oracle JDKs 25, 21, 17, 11, and 8 are expected to reach post-quantum cryptography capabilities comparable to JDK 27 by the end of 2027. JDK 27, releasing the following month after the announcement period described, already adds hybrid post-quantum key exchange for TLS 1.3. Whether other OpenJDK distributions receive the same backports depends on their individual maintainers. Developers planning PQC migrations across legacy JDK versions can follow roadmap updates on daily.dev.
Is Oracle changing how often Java security updates are released?
Yes, Oracle intends to shift Java security update processes from a quarterly to a monthly cadence, a transition planned to take much of 2027 and initially applying to Oracle JDKs only. OpenJDK Updates Project Lead Rob McKenna has proposed adopting the same monthly model for the six months following each JDK feature release, the period Oracle maintains that OpenJDK branch, with an out-of-cycle JDK 26.0.1.2 release already scheduled for August 18th. Java teams planning patch cycles can keep tabs on this cadence shift via daily.dev.