<p><strong>TLDR:</strong> Project Valhalla’s JEP 401 value classes are confirmed for JDK 28 after twelve years of development, representing the most significant Java language change in a decade. Spring Boot 4.1 shipped with gRPC auto-configuration, SSRF mitigation, and a Kotlin 2.3 baseline. Block migrated 450 JVM repositories into a monorepo handling 8,800 builds per week. A critical pre-auth RCE chain in Oracle PeopleSoft (CVSS 9.8) is being actively exploited in the wild.</p>
<hr>
<h2>Project Valhalla JEP 401 confirmed for JDK 28, ships as preview in March 2027</h2>
<p>After twelve years of development and 197,000 lines of code across 1,816 files, value classes are integrating into the OpenJDK mainline targeting JDK 28. Value classes eliminate object identity so the JVM can reduce memory overhead and improve cache locality — some existing classes like Integer will be migrated. It ships as a preview feature, not enabled by default, and Brian Goetz is explicit that deliberate breaking changes are coming: code that synchronizes on Integer objects will throw exceptions once Integer becomes a value class. Don’t expect it to exit preview by JDK 29. <a href="https://daily.dev/posts/8EeEspMNb" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Spring Boot 4.1 ships gRPC auto-configuration, SSRF mitigation, and Kotlin 2.3 baseline</h2>
<p>Spring Boot 4.1, released June 10, adds gRPC auto-configuration for both server and client with Netty and Servlet HTTP/2 transport, plus an InetAddressFilter for HTTP client SSRF mitigation. The Kotlin baseline moves from 2.2 to 2.3, lazy datasource connections land via spring.datasource.connection-fetch=lazy, and all APIs deprecated in 4.0 are removed. Apache Derby support is newly deprecated. Companion releases include Spring AI 2.0 GA, Spring Security 7.1.0, and Spring Data 2026.0.0. Spring Boot 4.2 is expected in November 2026. <a href="https://daily.dev/feed-by-ids?id=OpiKjwWDI&amp;id=BGkIzfVpk&amp;id=7X5pKYCHj" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Block migrates 450 JVM repositories into a monorepo, now running 8,800 builds per week</h2>
<p>Block consolidated Cash App and Square’s roughly 450 JVM repos into a single monorepo to address dependency version drift, diamond dependency issues, and cross-team coordination overhead. The monorepo now handles about 8,800 builds per week with p90 CI times around 10 minutes. Key investments include a custom IntelliJ plugin that swaps irrelevant projects for published JARs, dependency graph-based selective CI builds, and Gradle convention plugins enforcing module boundaries. Block is candid that the migration took longer than planned and advises against monorepos when platform team investment is lacking. <a href="https://daily.dev/feed-by-ids?id=ek4wxTdXf&amp;id=vvmZc9oYN" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>CVE-2026-35273: pre-auth RCE in Oracle PeopleSoft actively exploited since May 27</h2>
<p>A CVSS 9.8 pre-authentication RCE chain in PeopleSoft PeopleTools 8.61 and 8.62 exploits the PSIGW Integration Broker gateway via SSRF to reach the internal PSEMHUB servlet, then achieves code execution through Java XMLDecoder deserialization on web-tier restart. Execution happens inside the WebLogic JVM with no child process spawned and no outbound beacon, making conventional behavioral detection ineffective. Threat actor SHADOW-AETHER-015 (ShinyHunters) has been exploiting this since May 27 against over 100 organizations. Oracle issued an out-of-band patch June 10 — patch immediately and restrict PSIGW network exposure. <a href="https://daily.dev/posts/F19sJr0EU" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Kotlin 2.4 introduces experimental collection literals requiring compiler flag and IDEA 2026.2 EAP:</strong> Kotlin 2.4 ships collection literals as an experimental feature using bracket syntax instead of listOf()/setOf(), context-sensitive on declared type, with full IDE support requiring IntelliJ IDEA 2026.2 EAP and an explicit compiler flag in Gradle. <a href="https://daily.dev/posts/1Ziu0SDIP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Quarkus Data replaces Panache with Jakarta Data-backed repositories, ships in Quarkus 3.37.0:</strong> Quarkus Data is a new umbrella project for data access that replaces the fragmented Hibernate/Panache extensions with a single entry point backed by Jakarta Data (Jakarta EE 11), with compile-time annotation processor-generated repository implementations available from Quarkus 3.37.0 and shipping with Quarkus 4.0. <a href="https://daily.dev/posts/7KhexbFqD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Hibernate ORM 8.0.0.Beta1 released with Jakarta Persistence 4.0 and graph-based flushing:</strong> Hibernate ORM 8.0.0.Beta1 passes both the Jakarta Persistence and Jakarta Data TCKs through M5, adds graph-based flushing, row-level security with discriminator multi-tenancy, and flush-time bidirectionality management. <a href="https://daily.dev/posts/NJ5Nw9g21" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Strictland 0.3.0: snapshot-based JVM contract testing for message serialization with no broker required:</strong> Strictland 0.3.0 is available on Maven Central as a lightweight alternative to Pact or Spring Cloud Contracts, serializing messages in unit tests and committing snapshot files alongside code, with backward/forward compatibility checks and no broker, schema registry, or Docker dependency. <a href="https://daily.dev/feed-by-ids?id=wJOroK2Tz&amp;id=W2OlH6Xns" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>jqwik prompt injection: library embedded instruction to delete tests, exposing agentic coding risk:</strong> The jqwik property-based testing library was found to embed a prompt injection string in its test output instructing AI coding agents like Claude to delete all tests and code — a concrete demonstration of supply chain prompt injection risk for teams running agentic workflows against Java codebases. <a href="https://daily.dev/posts/w3hoJ9Z4p" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Spring Boot, JVM updates, and Java ecosystem news.

Java Digest

A roundup of major Java ecosystem news: Project Valhalla's JEP 401 value classes are confirmed for JDK 28 as a preview feature after 12 years of development, eliminating object identity for better memory and cache performance. Spring Boot 4.1 ships with gRPC auto-configuration, SSRF mitigation via InetAddressFilter, and a Kotlin 2.3 baseline. Block consolidated 450 JVM repos into a monorepo now running 8,800 builds/week with custom IntelliJ tooling and Gradle convention plugins. A critical CVSS 9.8 pre-auth RCE chain in Oracle PeopleSoft (CVE-2026-35273) is actively exploited via SSRF and Java XMLDecoder deserialization — Oracle issued an out-of-band patch. Also covered: Kotlin 2.4 collection literals, Quarkus Data replacing Panache, Hibernate ORM 8.0 Beta1, Strictland 0.3.0 contract testing, and a prompt injection risk found in the jqwik testing library.

Project Valhalla lands in JDK 28, Spring Boot 4.1 ships gRPC and SSRF fixes