This week's Java roundup for July 20th, 2026, features news highlighting: two JEPs proposed to target for JDK 28; new JEPs 540 and 541, Simple JSON API (Incubator) and Deprecate the macOS/x64 Port for Removal, respectively; the July 2026 Critical Patch Update; the GA release of Embable 1.0; Azul Payara 7.2.0; and Helidon 4.5.1.

OpenJDK

JEP 539, Strict Field Initialization in the JVM (Preview), has been elevated from Candidate to Proposed to Target for JDK 28. This JEP introduces strictly-initialized fields in the Java Virtual Machine that are required to be initialized before they are read. Therefore, default values such as 0 or null are never observed. This feature is available for use by compilers that emit class files. The review is expected to conclude on Thursday, July 30, 2026.

JEP 401, Value Objects (Preview), has been elevated from Candidate to Proposed to Target for JDK 28. Formerly known as Object Classes and Values (Preview), this JEP proposes to enhance the language with value objects, defined as objects that: only contain ** final** fields; do not have identity; and are solely distinguished by the values of their respective fields. The review is expected to conclude on Thursday, July 30, 2026.

JEP 541, Deprecate the macOS/x64 Port for Removal, has been elevated from its JEP Draft 8386091 to Candidate status. This JEP proposes to deprecate the macOS/x64 port as Apple no longer supports this architecture. Similar to JEP 449, Deprecate the Windows 32-bit x86 Port for Removal, the intent to remove this port in a future release to save on maintenance costs.

JEP 540, Simple JSON API (Incubator), has been elevated from its JEP Draft 8344154 to Candidate status. This JEP defines a simple, standard API for parsing and generating JSON documents without the need for an external library. This feature implements RFC 8259, The JavaScript Object Notation (JSON) Data Interchange Format, and supersedes JEP 198, Light-Weight JSON API, which is now closed and withdrawn.

Oracle has released versions 25.0.4, 21.0.12, 17.0.20, 11.0.32 and 8u501 of the JDK as part of their quarterly Critical Patch Update Advisory for July 2026. More details on this release may be found in the release notes for version 25.0.4, version 21.0.12, version 17.0.20, version 11.0.32 and version 8u501.

Based on a recent Integrated Cyber Center report, Oracle has announced that they are moving to deliver more frequent Critical Patch Updates (CPUs) beyond their existing quarterly updates. As stated in the blog post:

[These] CPUs provide an opportunity every month for targeted fixes that address high-priority vulnerabilities, instead of having to wait until the next quarterly CPU. The rationale is clear: the latest generation of AI is transforming how software vulnerabilities are identified and fixed, increasing the speed and scale of discovery and remediation.

The next CPU is scheduled to be released on August 18, 2026.

JDK 27

Build 32 of the JDK 27 early-access builds was made available this past week featuring updates from Build 31 that include fixes for various issues. Further details on this release may be found in the release notes.

JDK 28

Build 8 of the JDK 28 early-access builds was also made available this past week featuring updates from Build 7 that include fixes for various issues. More details on this release may be found in the release notes.

BellSoft

Concurrent with Oracle's Critical Patch Update (CPU) for July 2026, BellSoft has released CPU patches for versions 25.0.3.0.1, 21.0.11.0.1, 17.0.19.0.1, 11.0.31.0.1, 8u501 7u511 and 6u511 of Liberica JDK, their downstream distribution of OpenJDK, to address this list of CVEs. In addition, Patch Set Update (PSU) versions 26.0.2, 25.0.4, 21.0.12, 17.0.20, 11.0.32 and 8u502, containing CPU and non-critical fixes, have also been released.

With an overall total of 1252 fixes and backports, BellSoft states they have participated in eliminating 35 issues in all releases.

Embabel

14 months after its introduction to the Java community, the release of Embabel 1.0.0 delivers notable new features such as: experimental APIs, e.g., the ** TokenCountEstimator** interface, promoted from experimental to production; improved observability by exposing the health of the MCP server via Spring Boot Actuator; integration of the Z.ai GLM model; and updates/improvements to existing models. Further details on this release may be found in the release notes. InfoQ will follow up with a more detailed news story.

Azul Payara

The release of Azul Payara 7.2.0, the July 2026 edition, includes Community Edition 7.2026.7 Enterprise Edition 6.40.0 and Enterprise Edition 5.89.0. Along with bug fixes and component upgrades, all three editions ship with bug fixes, component upgrades and two new features: backwards compatibility to define implicit CDI beans using the internal ** glassfish-application.xml** file that eliminates the need to rely on a legacy descriptor; and the addition of Payara 6 deployment descriptors as a "forward-port" that allows an application to pin itself to a specific Payara major version.

This release also ports the resolution to CVE-2024-9342, a vulnerability in GlassFish 7.0.16 and earlier that allows an attacker to apply a brute-force authentication attack on the Administration Console and REST API due to no limitation in the number of failed login attempts.

More details on these releases may be found in the release notes.

Helidon

The release of Helidon 4.5.1 provides notable changes such as: requests in the GraphQL component now require authentication by default; cookies and authorization headers in the WebClient component are now stripped on cross-origin redirects and reject the HTTP Status 307 and HTTP Status 308 redirects; and OIDC access-token cookies are now encrypted by default. Further details on this release may be found in the release notes.