Oracle has shipped version 27 of the Java programming language and virtual machine, bringing nine enhancement proposals to the platform's second non-long-term-support release since JDK 25. The release emphasizes post-quantum cryptography, security hardening, and performance improvements, with five features still advancing through preview and incubator stages. The update continues Oracle's strategy to embed standardized quantum-resistant algorithms across the Java ecosystem, while also making the G1 garbage collector the default in all environments and introducing compact object headers by default.
The nine Java Enhancement Proposals in this release include JEP 523, making G1 the default garbage collector across all environments; JEP 527, adding post-quantum hybrid key exchange for TLS 1.3; JEP 534, enabling compact object headers by default; and JEP 536, introducing JFR in-process data redaction. Five features remain in preview or incubator: JEP 531, lazy constants in its third preview; JEP 532, primitive types in patterns, instanceof, and switch in its fifth preview; JEP 533, structured concurrency in its seventh preview; JEP 537, the Vector API in its twelfth incubator; and JEP 538, PEM encodings of cryptographic objects in its third preview. Since JDK 24, Oracle has been layering in security capabilities that provide a solid base for developers to create more secure applications, according to an Oracle blog post.
The post-quantum hybrid key exchange feature enhances the implementation of RFC 8446, the Transport Layer Security Protocol Version 1.3 specification, using a hybrid key exchange draft currently being developed by the Internet Engineering Task Force in conjunction with the quantum-resistant module-lattice-based key encapsulation mechanism delivered in JDK 24. Oracle is executing a roadmap that delivers standardized post-quantum cryptography algorithms and PQC-enabled TLS to current long-term support releases, helping reduce friction for developers and enterprises adopting these technologies, according to the blog post. The PEM encodings feature, now in its third preview after two rounds in JDK 25 and JDK 26, offers an API for encoding objects that represent cryptographic keys, certificates, and certificate revocation lists into the widely-used Privacy-Enhanced Mail transport format, and for decoding from that format back into objects.
Oracle also introduced the Java Verified Portfolio at JavaOne 2026, an ecosystem of Oracle-supported technologies that now includes Helidon 27, JavaFX 27, Jipher 20, and a JVP extension for Visual Studio Code. Helidon 27, now aligned with OpenJDK versioning, is the first release following Oracle's Tip & Tail Model of Library Development, with Helidon 27 serving as the Tip and Helidon 4.5.5 as the Tail, allowing development teams requiring a longer-lived production baseline to remain on the latter. JavaFX 27 delivers a metal rendering pipeline on macOS for smoother performance on modern Apple hardware, enhanced text editing controls, and continued accessibility improvements. The formal release date for JDK 28 is expected in March 2027, with six enhancement proposals already targeted, including long-awaited features from Project Valhalla: JEP 539, strict field initialization in the JVM, and JEP 401, value classes and objects, both in preview—representing a significant milestone that will ultimately allow the Vector API to be elevated from incubation to preview. The post-quantum cryptography push reflects a recognition that quantum computing threats require preemptive architectural changes rather than reactive patches, while the Valhalla features signal Java's continued evolution toward performance parity with lower-level languages without sacrificing developer ergonomics.