"JSON API, Valhalla Progress, LTS ❤️ PQC" [IJN]

This episode of the Inside Java Podcast is the Ask the Architect session from Devoxx Belgium 2026, where the audience members literally asked the Java architects their questions. They inquired about custom virtual thread schedulers, AI's impact on the development of Java itself, Valhalla features, string templates, better modules, and more.

Object-Oriented Programming offers a lot of flexibility for modelling diverse domains but not all elements need that flexibility. Data, specifically, is often better modeled by simple, immutable types and while OOP does not prevent that, it can make it a bit cumbersome. So in recent and coming years, Java has gained and will gain a number of features that improve the situation: From flexible constructor bodies to records and value classes, from withers to lazy constants, and more - they all stand on their own, but they also come together to allow us to more expressively and elegantly define, construct, copy, and access immutable data. In this "Ask the Architects" episode of the Inside Java Podcast, recorded during JavaOne 2026, Nicolai Parlog talks to Dan Smith, contributor to projects Amber and Valhalla and Senior Java Platform Developer at Oracle. Show Notes: Better Tools for Immutable Data: https://www.youtube.com/watch?v=BdLND9D81lI JEP 513: Flexible Constructor Bodies: https://openjdk.org/jeps/513 JEP 401: Value Objects (Preview): https://openjdk.org/jeps/401 JEP 468: Derived Record Creation (Preview): https://openjdk.org/jeps/468 JEP 547: Lazy Constants (Fourth Preview): https://openjdk.org/jeps/547

On August 18th, 2026 a mail pops up on the hotspot-compiler-dev mailing list and it describes something that is not supposed to happen: a serious new bug in a JDK release candidate phase, just a few weeks before general availability. Apparently, under very specific circumstances, some buffer contents aren't correctly copied and strings can get corrupted. This is bad, very bad even, and obviously requires analysis and a fix. This is the story of the structure and community that fixes bugs like these and how they operate. We also take a quick look at JavaOne, the Inside Java Podcast, and JDK 28, which is shaping up to be a big release. Links: A critical bug: JEP 3: https://openjdk.org/jeps/3 the original issue: https://bugs.openjdk.org/browse/JDK-8373591 the original PR: https://github.com/openjdk/jdk/pull/28789 Lorenzo's bug description: https://mail.openjdk.org/archives/list/[email protected]/thread/5NVKBE3C5T5ULKVO5T3RTUQZDIXQMHBE/ Chris' alarm for the P1 bug: https://mail.openjdk.org/archives/list/[email protected]/thread/EPJNIMIAROC2QELIZE5MAGU4D6S3FEVG/#K52LJL4HZJE565UBU465PT4ZBRC2XV4Y the bug in JDK 27: https://bugs.openjdk.org/browse/JDK-8390546 backing out the change on the mail branch: https://bugs.openjdk.org/browse/JDK-8390590 backporting the backout to JDK 27: https://bugs.openjdk.org/browse/JDK-8390663 Mark's confirmation: https://mail.openjdk.org/archives/list/[email protected]/message/K52LJL4HZJE565UBU465PT4ZBRC2XV4Y/ redoing the change on the main branch: https://bugs.openjdk.org/browse/JDK-8390617 Quality Outreach: https://wiki.openjdk.org/spaces/quality/pages/18448461/Quality+Outreach JavaOne: https://javaone.com JDK 28: early-access builds: https://inside.java/podcast/ feature list: https://openjdk.org/projects/jdk/28/  

Given how prevalent Java is on web servers throughout the internet, security in Java is of critical importance. There's the security of the JDK itself, of course, which is overseen by the OpenJDK Security Group, which you should report JDK vulnerabilities to. But there are also the algorithms and features Java offers applications that are built on top of it and the cryptographic road map is an essential part of that development process. In recent years, post-quantum encryption has made big splashes but Java now also supports PEM texts and is considering the adoption of Argon2. In this "Ask the Architects" episode of the Inside Java Podcast, recorded during JavaOne 2026, Nicolai Parlog talks to Sean Mullan, Lead of the OpenJDK Security Group and Tech Lead of the Oracle Security Libraries Team. "Ask the Architects" is our podcast show, where we talk to experts in OpenJDK about their work on the Java language, API, and runtime. Show notes: OpenJDK Security Group: https://openjdk.org/groups/security/ Oracle JDK Cryptographic Roadmap: https://www.java.com/en/jre-jdk-cryptoroadmap.html Post-Quantum Hybrid Key Exchange for TLS 1.3: https://inside.java/2026/02/17/tls-post-quantum-hybrid-key-exchange/ JEP 542 - PEM Encodings of Cryptographic Objects: https://openjdk.org/jeps/542 JEP Draft for Argon2: https://openjdk.org/jeps/8377081

Java projects that want to reduce their launch times need to look into Java's new ahead-of-time capabilities. A training run is used to populate a cache that, in production, allows the JVM to short-circuit many operations, like class loading and linking, profile gathering, and - probably soon - JIT compilation. To get the most out this feature, a good training run is essential. Netflix approach is pretty much the ideal one: use a canary deployment of a new version to collect training data and create the cache for the remaining deployments from that. But, from time scales to checkpointing, from managing to inspecting cache files, there are a number of details to consider. In this "Input/Output" episode of the Inside Java Podcast, recorded during JavaOne 2026, Nicolai Parlog talks to Martin Chalupa, Senior Performance Engineer at Netflix and John Rose, JVM Architect at Oracle and Lead of OpenJDK's Project Leyden. "Input/Output" is our new show, where we talk to people outside of OpenJDK to bring you their perspectives and insights into what's happening in the Java ecosystem. This special episode comes with an OpenJDK architect to boot. Show notes: JDK 27: https://jdk.java.net/27 Project Leyden: https://openjdk.org/projects/leyden/ Martin's talk at JavaOne 2026: https://www.youtube.com/watch?v=4kEh8hxAP4U

Java 27 is heading for release on September 15th. As with every release of the JDK there are a host of changes that will impact developers, from new features, to changes in behavior of existing features. In this episode of the Inside Java Newscast we will be "declassifying" all the developer impacting changes in Java 27. 

OpenJDK's Project Valhalla is improving Java's support for custom numerical types. That goes beyond value types and also encompasses explorations into operator support. While Java is extremely unlikely to ever allow arbitrary operator definitions, it may well support limited operator overloading, so custom value types could be added or multiplied with plus or multiplication signs instead of annoying method calls. In this "Ask the Architects" episode of the Inside Java Podcast, recorded during JavaOne 2026, Nicolai Parlog talks to Joe Darcy, Valhalla committer in the Java Platform Group at Oracle. "Ask the Architects" is our podcast show, where we talk to experts in OpenJDK about their work on the Java language, API, and runtime.

JEP 540 proposes to incubate a simple JSON API and is currently proposed to target JDK 28. The pull request for Project Valhalla's JEPs 401 and 539 were merged and value types are available as a preview feature in the latest JDK 28 early-access builds. Oracle plans to backport post-quantum cryptography to Oracle JDKs with LTS (25, 21, 17, 11, and 8) and move Java to monthly security updated (currently quarterly). JDK 28 EA builds: https://jdk.java.net/28/ Dan's mail re values: https://mail.openjdk.org/archives/list/[email protected]/thread/Y72NRXM7KYBX43OKYBQMVKOZDWKG4MHS/ Angelos' mail re primitive patterns: https://mail.openjdk.org/archives/list/[email protected]/thread/WSXW4QMJ3EBIHIULEB25HUAMR5JB767H/ JEP 540: https://openjdk.org/jeps/540 JEP 496: https://openjdk.org/jeps/496 JEP 497: https://openjdk.org/jeps/497 JEP 572: https://openjdk.org/jeps/572 Blog post in PQC in LTS: https://blogs.oracle.com/java/post-quantum-cryptography-in-long-term-support-jdk-releases Accelerated Vulnerability Detection and Response: https://blogs.oracle.com/security/accelerating-vulnerability-detection-and-response-at-oracle More frequent Oracle JDK releases:  https://blogs.oracle.com/java/transitioning-java-to-more-frequent-security-updates More Frequent OpenJDK releases: https://mail.openjdk.org/archives/list/[email protected]/thread/SVHDNJDY62MX6YBEA4FSMW4U72H77F6S/ JDK 27 RC pushed back: https://mail.openjdk.org/archives/list/[email protected]/thread/EYKJPUAZ4BX4DXD7H4C5ETWJFNQZBFO5/ OpenJDK Mail Search: https://openjdk.barlasgarden.com/ 

Helidon 4.4 was released in April 2026 and stands out from other web frameworks by embracing new Java features as early as possible, particularly virtual threads and ahead-of-time computation. It is also aiming to become an OpenJDK project in the coming months. In this "Input/Output" episode of the Inside Java Podcast, recorded during JavaOne 2026, Nicolai Parlog talks to Joe Di Pol, Lead Principal Platform Software Engineer at Oracle where he works on Helidon. "Input/Output" is our new show, where we talk to people outside of OpenJDK to bring you their perspectives and insights into what's happening in the Java ecosystem.