JDK 27 arrived after its first release candidate slipped two weeks so Oracle could issue a Critical Security Patch Update tied to vulnerabilities and exploits identified by stronger AI models.
Nine JEPs headline the release, with five preview or incubator items returning in mostly incremental form, including the Vector API, structured concurrency, lazy constants, primitive patterns, and PEM encodings.
Four final features make broader platform changes: compact object headers are now on by default, G1 becomes the default garbage collector in all environments, TLS 1.3 gains post-quantum hybrid key exchange, and JFR adds in-process data redaction.
Compact object headers delivered the clearest performance claim, with the JEP citing a 22% heap-space reduction and 8% lower CPU use on the SPECjbb2015 benchmark.
JDK 28 is already shaping up as the bigger release, with 6 targeted JEPs including a long-awaited JSON API, macOS/x64 deprecation, and early Project Valhalla pieces.