Java News Roundup – OpenJDK JEPs, Hazelcast, Quarkus, Hibernate, Koog, JHipster, and Endive

OpenJDK – JEP status shifts for JDK 27

JEP 538 – PEM Encodings of Cryptographic Objects (Third Preview)

After two preview releases in JDK 25 and 26, the JEP remains Proposed → Target for JDK 27. Community feedback prompted a third preview rather than a final feature. The API now:

• Provides a PemRecord class with constructors that accept raw Base64 byte arrays.
• Renames DEREncodable to BinaryEncodable to better describe the binary payload.
• Supports conversion between PEM text and PKCS #8 / X.509 binary formats. The extended review ends on June 3 2026.

JEP 528 – Post‑Mortem Crash Analysis with jcmd

Originally slated for JDK 27, the JEP has been reverted to Candidate and retargeted for JDK 28. It moves crash‑diagnostics from jhsdb/SA to the jcmd tool, simplifying serviceability workflows.

JEP 536 – JFR In‑Process Data Redaction

Now Proposed → Target → Targeted for JDK 27. JFR will be able to redact:

• Command‑line arguments
• Initial environment variable values
• System properties This helps teams meet compliance requirements without disabling recording.

JDK 27 early‑access build 24

Build 24 shipped with bug‑fixes on top of Build 23. Developers can file bugs in the Java Bug Database.

---

Spring Framework – Spring AI 2.0 milestone 8

• MistralAiApi: Jackson mapping now aligns with the official Mistral AI OpenAPI spec.
• Anthropic rate‑limit headers (requests-limit, tokens-limit, input‑tokens-limit) are exposed via ChatResponseMetadata.

More details are in the release notes.

---

Hazelcast Platform 5.7.0

• JDK 25 support – the platform runs on the latest LTS preview.
• Dynamic diagnostic logging graduates from beta to GA.
• mapWithMerging(), mapWithUpdating(), mapWithEntryProcessor() now resolve classes from a job’s User Code Namespace during deserialization, fixing class‑loader issues.
• Jet back‑pressure metrics have been improved for more accurate flow‑control.

See the release notes and the "What’s New" page for breaking changes.

---

Quarkus 3.36.0

• Experimental Signals extension – enables loosely‑coupled components to emit and listen for signals, similar to an internal event bus.
• SPIFFE JWT support – client authentication can now use SPIFFE‑issued JWTs, simplifying zero‑trust setups.

Full details are in the Quarkus changelog.

---

Hibernate ORM 7.4.0

• @Temporal and @Audited annotations are now supported out of the box.
• CacheMode.REFRESH_SESSION added to force a query to refresh entities already present in the persistence context.
• Google Cloud Spanner support (both GoogleSQL and PostgreSQL dialects) expands cloud‑native persistence options.

Refer to the Hibernate ORM release notes for migration guidance.

---

Koog 1.0.0 – GA release

Koog is JetBrains’ framework for building AI agents in Kotlin and Java. The GA release introduces:

• A standard naming convention for blocking wrappers across all modules, making the API more predictable.
• Planner‑based agents now support checkpoint and restore, improving persistence and memory performance.
• A decoupled HTTP transport layer, allowing projects to plug in any HTTP client library.

The official release notes contain a migration guide from the 0.x preview series.

---

JHipster 9.1.0

• SecurityUtils.getCurrentUserJWT() now returns an instance of Spring Security’s Jwt class, easing integration with newer Spring Security features.
• Blueprints generate TypeScript files instead of JavaScript, aligning generated front‑end code with the current TypeScript‑first ecosystem.

Check the JHipster changelog for a full list of dependency upgrades.

---

Endive – JVM‑native WebAssembly runtime

Bytecode Alliance unveiled Endive, a runtime that executes WebAssembly modules directly on the JVM without JNI, native libraries, or platform‑specific binaries. Endive builds on the concepts from Chicory (last released version 1.7.5 in March 2026). While Endive does not yet have a formal release process, the project is open‑source and can be tried via the GitHub repository.

Key benefits:

• Zero native dependencies – deployment is as simple as adding a JAR.
• Fast startup – leveraging the JVM’s class‑loading and JIT compilation.
• Security sandbox – inherits the JVM’s sandboxing model while providing Wasm‑specific isolation.

Explore the project on the Bytecode Alliance site and the Chicory repo for background.

---

Migration checklist

1. OpenJDK – Update to the latest early‑access build if you need the preview PEM API; otherwise, wait for JDK 27 final.
2. Hazelcast – Upgrade to 5.7.0 and test custom UserCodeNamespace class loading.
3. Quarkus – Add the quarkus-signals extension if you want internal signal handling; enable SPIFFE JWT via quarkus.security.spiiffe.enabled=true.
4. Hibernate – Replace any manual cache refresh logic with CacheMode.REFRESH_SESSION where appropriate.
5. Koog – Refactor imports to use the new blocking‑wrapper names; switch to the new HTTP transport if you previously relied on the built‑in client.
6. JHipster – Adjust front‑end build pipelines to consume TypeScript output; update security code to handle the Jwt object.
7. Endive – For experimental Wasm workloads, add the endive-runtime dependency and run java -jar endive-runtime.jar your-module.wasm.

---

Closing thoughts

May’s roundup shows the Java ecosystem moving toward tighter security (JFR redaction), broader cloud support (Spanner, JDK 25), and new execution models (Wasm on the JVM). Keeping an eye on the JEP status changes will help you plan for JDK 27, while the library updates provide immediate opportunities to improve observability, performance, and developer ergonomics.

---

Michael Redlich – Java Champion, Java Queue Lead Editor, and longtime community organizer.