This content was generated with the help of AI and published without prior human review. It may contain errors and is not professional advice. Report a problem: info@delionsoft.com.
Oracle has released Java 27, the second non-LTS release after JDK 25. The final feature set contains nine JEPs, five of them still in preview or incubator stages, with the emphasis on security, garbage collection defaults and language work that will land later. Alongside the JDK, Helidon 27, JavaFX 27 and Jipher 20 were published under what Oracle now calls the Java Verified Portfolio.
What happened
The two finalised items most teams will notice are JEP 527, hybrid post-quantum key exchange for TLS 1.3, and JEP 534, compact object headers enabled by default. JEP 523 makes G1 the default garbage collector in all environments, and JEP 536 adds in-process data redaction to JDK Flight Recorder. The rest remain unfinished: lazy constants (third preview), primitive types in patterns (fifth preview), structured concurrency (seventh preview), PEM encodings of cryptographic objects (third preview) and the Vector API, now in its twelfth incubation with no substantial implementation changes since JDK 25.
The post-quantum work is part of a longer sequence that began with the module-lattice key encapsulation and signature algorithms in JDK 24 and the Key Derivation Function API. According to the original report, Oracle intends to bring standardised post-quantum algorithms and PQC-enabled TLS to current LTS releases as well, which matters more than the non-LTS release itself. The hybrid key exchange relies on an IETF specification that is still in draft.
Looking ahead, JDK 28 is expected in March 2027 with a feature freeze in early December 2026, and includes the first Project Valhalla previews: strict field initialization in the JVM and value classes and objects.
Why it matters
For most SMB teams, Java 27 is not a production target. It is a test bed. Two things are worth acting on now.
First, the crypto direction is no longer theoretical. Hybrid key exchange means TLS handshakes carry both a classical and a post-quantum component, which changes handshake sizes and can surprise middleboxes, load balancers and pinning logic. Better to find that out in a staging environment than during a compliance review.
Second, compact object headers by default and G1 everywhere will change memory footprint and GC behaviour when you eventually move to the next LTS. Container memory limits and heap sizing assumptions tuned years ago deserve a re-check.
The Helidon 27 release also introduces Oracle's Tip and Tail model, with Helidon 4.5.5 as the longer-lived baseline. If you run Helidon, decide deliberately which track you are on rather than drifting.
What to do
- Add JDK 27 to your CI matrix as a non-blocking job. Six months of early warnings costs less than a rushed LTS migration.
- Inventory where your services terminate TLS and whether the Java side controls the handshake at all. If a proxy or CDN sits in front, your post-quantum readiness depends on that layer, not the JDK.
- Benchmark heap and GC behaviour under compact object headers on a representative workload, and record the numbers before you need them.
- Treat previews as previews. Structured concurrency and primitive patterns are still moving; keep them out of code you have to support.