javajava-27post-quantumpattern-matchinggarbage-collectorconcurrencysecurity

Java 27 Is Here! What's New?

Java 27 ships 9 JEPs across security, language design, performance, and libraries. From post-quantum encryption to compact object headers, here's every feature explained with code examples and analogies.

Elattar Saad

Fri, 25th September 202612 min read

GC Type	Best For	Trade-off
Serial	Small apps, single CPU	Simple, but stops the world for full GC
Parallel	Throughput-focused batch jobs	Fast, but pauses can be long
G1	General-purpose (now default)	Balanced latency and throughput
Epsilon	No-op GC (testing/benchmarking)	No memory reclamation
ZGC	Ultra-low latency	Higher memory overhead
Shenandoah	Ultra-low latency	Higher CPU overhead

Data Type	Examples
Command-line arguments	`-Ddb.password=secret123` → `-Ddb.password=[REDACTED]`
Environment variables	`API_KEY=abc123` → `API_KEY=[REDACTED]`
System properties	`javax.net.ssl.keyStorePassword=secret` → `[REDACTED]`

JEP	Feature	Category	Status
527	Post-Quantum Hybrid Key Exchange for TLS 1.3	Security	Final
538	PEM Encodings of Cryptographic Objects	Security	Preview (3rd)
532	Primitive Types in Patterns, instanceof, switch	Language	Preview (5th)
523	G1 as Default GC Everywhere	Performance	Final
534	Compact Object Headers by Default	Performance	Final
531	Lazy Constants	Library	Preview (3rd)
533	Structured Concurrency	Library	Preview (7th)
537	Vector API	Library	Incubator (12th)
536	JFR In-Process Data Redaction	Tooling	Final

// Your existing HTTPS code continues to work exactly the same
URL url = new URL("https://api.example.com/data");
HttpURLConnection conn = (HttpURLConnection) url.openConnection();

// Behind the scenes, the TLS handshake now uses hybrid key exchange
// combining ML-KEM (quantum-resistant) with traditional X25519
InputStream in = conn.getInputStream();
// ... read response

// Your existing HTTPS code continues to work exactly the same
URL url = new URL("https://api.example.com/data");
HttpURLConnection conn = (HttpURLConnection) url.openConnection();

// Behind the scenes, the TLS handshake now uses hybrid key exchange
// combining ML-KEM (quantum-resistant) with traditional X25519
InputStream in = conn.getInputStream();
// ... read response

import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.util.HexFormat;
import java.util.Objects;

// Generate a key pair for demonstration
KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
keyGen.initialize(2048);
KeyPair keyPair = keyGen.generateKeyPair();

// --- Encoding: Convert objects to PEM text ---

// Encode private key to PEM
PEMEncoder encoder = PEMEncoder.of();
String privatePem = encoder.encodeToString(keyPair.getPrivate());
System.out.println("Private Key PEM:");
System.out.println(privatePem);

// Encode public key to PEM
String publicPem = encoder.encodeToString(keyPair.getPublic());
System.out.println("Public Key PEM:");
System.out.println(publicPem);

// --- Decoding: Read PEM text back to objects ---

PEMDecoder decoder = PEMDecoder.of();

// Decode private key from PEM
PrivateKey decodedPrivate = decoder.decode(privatePem, PrivateKey.class);
System.out.println("Decoded private key algorithm: " + decodedPrivate.getAlgorithm());

// Decode public key from PEM
PublicKey decodedPublic = decoder.decode(publicPem, PublicKey.class);
System.out.println("Decoded public key algorithm: " + decodedPublic.getAlgorithm());

// Verify the decoded keys match the originals
System.out.println("Private keys match: " + Objects.equals(
    keyPair.getPrivate().getEncoded(), decodedPrivate.getEncoded()));
System.out.println("Public keys match: " + Objects.equals(
    keyPair.getPublic().getEncoded(), decodedPublic.getEncoded()));

import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.util.HexFormat;
import java.util.Objects;

// Generate a key pair for demonstration
KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
keyGen.initialize(2048);
KeyPair keyPair = keyGen.generateKeyPair();

// --- Encoding: Convert objects to PEM text ---

// Encode private key to PEM
PEMEncoder encoder = PEMEncoder.of();
String privatePem = encoder.encodeToString(keyPair.getPrivate());
System.out.println("Private Key PEM:");
System.out.println(privatePem);

// Encode public key to PEM
String publicPem = encoder.encodeToString(keyPair.getPublic());
System.out.println("Public Key PEM:");
System.out.println(publicPem);

// --- Decoding: Read PEM text back to objects ---

PEMDecoder decoder = PEMDecoder.of();

// Decode private key from PEM
PrivateKey decodedPrivate = decoder.decode(privatePem, PrivateKey.class);
System.out.println("Decoded private key algorithm: " + decodedPrivate.getAlgorithm());

// Decode public key from PEM
PublicKey decodedPublic = decoder.decode(publicPem, PublicKey.class);
System.out.println("Decoded public key algorithm: " + decodedPublic.getAlgorithm());

// Verify the decoded keys match the originals
System.out.println("Private keys match: " + Objects.equals(
    keyPair.getPrivate().getEncoded(), decodedPrivate.getEncoded()));
System.out.println("Public keys match: " + Objects.equals(
    keyPair.getPublic().getEncoded(), decodedPublic.getEncoded()));

Object value = 42;

// Before Java 27: verbose, error-prone
String description;
if (value instanceof Integer i) {
    if (i > 0) {
        description = "positive integer: " + i;
    } else {
        description = "non-positive integer: " + i;
    }
} else if (value instanceof String s) {
    description = "a string: " + s;
} else {
    description = "something else";
}

// After Java 27: clean, expressive
String description = switch (value) {
    case int i when i > 0 -> "positive integer: " + i;
    case int i -> "non-positive integer: " + i;
    case String s -> "a string: " + s;
    default -> "something else";
};

Object value = 42;

// Before Java 27: verbose, error-prone
String description;
if (value instanceof Integer i) {
    if (i > 0) {
        description = "positive integer: " + i;
    } else {
        description = "non-positive integer: " + i;
    }
} else if (value instanceof String s) {
    description = "a string: " + s;
} else {
    description = "something else";
}

// After Java 27: clean, expressive
String description = switch (value) {
    case int i when i > 0 -> "positive integer: " + i;
    case int i -> "non-positive integer: " + i;
    case String s -> "a string: " + s;
    default -> "something else";
};

// Processing sensor readings that come as different types
Object[] readings = { 42, 3.14, true, "N/A", -7 };

for (Object reading : readings) {
    String result = switch (reading) {
        case int i when i > 0 -> "✅ Positive reading: " + i;
        case int i -> "⚠️ Negative reading: " + i;
        case double d -> "📊 Decimal value: " + d;
        case boolean b -> "🔘 Status flag: " + b;
        case String s -> "📝 Text data: " + s;
        default -> "❓ Unknown type";
    };
    System.out.println(result);
}

// Output:
// ✅ Positive reading: 42
// 📊 Decimal value: 3.14
// 🔘 Status flag: true
// 📝 Text data: N/A
// ⚠️ Negative reading: -7

// Processing sensor readings that come as different types
Object[] readings = { 42, 3.14, true, "N/A", -7 };

for (Object reading : readings) {
    String result = switch (reading) {
        case int i when i > 0 -> "✅ Positive reading: " + i;
        case int i -> "⚠️ Negative reading: " + i;
        case double d -> "📊 Decimal value: " + d;
        case boolean b -> "🔘 Status flag: " + b;
        case String s -> "📝 Text data: " + s;
        default -> "❓ Unknown type";
    };
    System.out.println(result);
}

// Output:
// ✅ Positive reading: 42
// 📊 Decimal value: 3.14
// 🔘 Status flag: true
// 📝 Text data: N/A
// ⚠️ Negative reading: -7

// Check your current default GC
java -XX:+PrintFlagsFinal -version | grep UseG1GC

// You should see:
// product bool UseG1GC = true {product} {ergonomic}

// If you want to use ZGC instead (for ultra-low latency)
java -XX:+UseZGC -jar myapp.jar

// If you want the old parallel collector (for batch processing)
java -XX:+UseParallelGC -jar myapp.jar

// Check your current default GC
java -XX:+PrintFlagsFinal -version | grep UseG1GC

// You should see:
// product bool UseG1GC = true {product} {ergonomic}

// If you want to use ZGC instead (for ultra-low latency)
java -XX:+UseZGC -jar myapp.jar

// If you want the old parallel collector (for batch processing)
java -XX:+UseParallelGC -jar myapp.jar

import java.lang.foreign.Arena;
import java.lang.foreign.FunctionDescriptor;
import java.lang.foreign.Linker;
import java.lang.foreign.MemoryLayout;
import java.lang.foreign.MemorySegment;
import java.lang.foreign.SymbolLookup;
import java.lang.foreign.ValueLayout;
import java.lang.invoke.MethodHandle;
import java.lang.invoke.VarHandle;

// Lazy constant: expensive computation happens only once, on first access
LazyConstant<String> databaseConfig = LazyConstant.of(() -> {
    System.out.println("Loading database configuration... (expensive)");
    // Simulate expensive work: reading from disk, parsing YAML, etc.
    Thread.sleep(1000);
    return "jdbc:postgresql://localhost:5432/mydb";
});

// First access: triggers the computation
System.out.println("Before first access");
String config = databaseConfig.get();  // Computation happens here
System.out.println("Config: " + config);

// Subsequent accesses: instantly reused, no recomputation
String again = databaseConfig.get();  // Returns cached value
System.out.println("Same config: " + again);

// Output:
// Before first access
// Loading database configuration... (expensive)
// Config: jdbc:postgresql://localhost:5432/mydb
// Same config: jdbc:postgresql://localhost:5432/mydb

import java.lang.foreign.Arena;
import java.lang.foreign.FunctionDescriptor;
import java.lang.foreign.Linker;
import java.lang.foreign.MemoryLayout;
import java.lang.foreign.MemorySegment;
import java.lang.foreign.SymbolLookup;
import java.lang.foreign.ValueLayout;
import java.lang.invoke.MethodHandle;
import java.lang.invoke.VarHandle;

// Lazy constant: expensive computation happens only once, on first access
LazyConstant<String> databaseConfig = LazyConstant.of(() -> {
    System.out.println("Loading database configuration... (expensive)");
    // Simulate expensive work: reading from disk, parsing YAML, etc.
    Thread.sleep(1000);
    return "jdbc:postgresql://localhost:5432/mydb";
});

// First access: triggers the computation
System.out.println("Before first access");
String config = databaseConfig.get();  // Computation happens here
System.out.println("Config: " + config);

// Subsequent accesses: instantly reused, no recomputation
String again = databaseConfig.get();  // Returns cached value
System.out.println("Same config: " + again);

// Output:
// Before first access
// Loading database configuration... (expensive)
// Config: jdbc:postgresql://localhost:5432/mydb
// Same config: jdbc:postgresql://localhost:5432/mydb

public class AiModelService {
    // Lazy constant: model loads only when first needed
    private final LazyConstant<AiModel> model = LazyConstant.of(() -> {
        System.out.println("Loading AI model... (this takes a while)");
        return AiModel.loadFromDisk("models/sentiment-analysis.bin");
    });

    public String analyzeSentiment(String text) {
        // model.get() triggers loading on first call, reuses after
        return model.get().predict(text);
    }
}

// Usage:
AiModelService service = new AiModelService();

// First call: loads the model (slow)
String result1 = service.analyzeSentiment("This movie is great!");

// Second call: model already loaded (fast)
String result2 = service.analyzeSentiment("This book is terrible!");

public class AiModelService {
    // Lazy constant: model loads only when first needed
    private final LazyConstant<AiModel> model = LazyConstant.of(() -> {
        System.out.println("Loading AI model... (this takes a while)");
        return AiModel.loadFromDisk("models/sentiment-analysis.bin");
    });

    public String analyzeSentiment(String text) {
        // model.get() triggers loading on first call, reuses after
        return model.get().predict(text);
    }
}

// Usage:
AiModelService service = new AiModelService();

// First call: loads the model (slow)
String result1 = service.analyzeSentiment("This movie is great!");

// Second call: model already loaded (fast)
String result2 = service.analyzeSentiment("This book is terrible!");

// Old way: threads can leak, errors are hard to propagate
ExecutorService executor = Executors.newFixedThreadPool(10);

Future<String> userFuture = executor.submit(() -> fetchUser());
Future<String> ordersFuture = executor.submit(() -> fetchOrders());

try {
    String user = userFuture.get();
    String orders = ordersFuture.get();
    System.out.println(user + orders);
} catch (Exception e) {
    // If ordersFuture fails, userFuture keeps running!
    // Thread leak: orphaned thread continues in background
}

// Old way: threads can leak, errors are hard to propagate
ExecutorService executor = Executors.newFixedThreadPool(10);

Future<String> userFuture = executor.submit(() -> fetchUser());
Future<String> ordersFuture = executor.submit(() -> fetchOrders());

try {
    String user = userFuture.get();
    String orders = ordersFuture.get();
    System.out.println(user + orders);
} catch (Exception e) {
    // If ordersFuture fails, userFuture keeps running!
    // Thread leak: orphaned thread continues in background
}

import jdk.incubator.concurrent.StructuredTaskScope;

// New way: structured, predictable, safe
try (var scope = StructuredTaskScope.open()) {
    Subtask<String> user = scope.fork(() -> fetchUser());
    Subtask<String> orders = scope.fork(() -> fetchOrders());

    scope.join();  // Waits for both to complete

    // If either fails, both are cancelled
    System.out.println(user.get() + orders.get());
}
// Scope is closed here: all tasks are guaranteed to be done

import jdk.incubator.concurrent.StructuredTaskScope;

// New way: structured, predictable, safe
try (var scope = StructuredTaskScope.open()) {
    Subtask<String> user = scope.fork(() -> fetchUser());
    Subtask<String> orders = scope.fork(() -> fetchOrders());

    scope.join();  // Waits for both to complete

    // If either fails, both are cancelled
    System.out.println(user.get() + orders.get());
}
// Scope is closed here: all tasks are guaranteed to be done

import jdk.incubator.concurrent.StructuredTaskScope;

public class OrderService {
    private final UserService userService;
    private final InventoryService inventoryService;
    private final PaymentService paymentService;

    public OrderSummary processOrder(String orderId) throws Exception {
        try (var scope = StructuredTaskScope.open()) {
            // Fork all three calls in parallel
            Subtask<User> user = scope.fork(() -> userService.getUser(orderId));
            Subtask<Inventory> inventory = scope.fork(() -> inventoryService.checkStock(orderId));
            Subtask<Payment> payment = scope.fork(() -> paymentService.processPayment(orderId));

            scope.join();  // Wait for all to complete

            // All three succeeded
            return new OrderSummary(user.get(), inventory.get(), payment.get());

        } // Automatic: if any task failed, all others are cancelled
    }
}

import jdk.incubator.concurrent.StructuredTaskScope;

public class OrderService {
    private final UserService userService;
    private final InventoryService inventoryService;
    private final PaymentService paymentService;

    public OrderSummary processOrder(String orderId) throws Exception {
        try (var scope = StructuredTaskScope.open()) {
            // Fork all three calls in parallel
            Subtask<User> user = scope.fork(() -> userService.getUser(orderId));
            Subtask<Inventory> inventory = scope.fork(() -> inventoryService.checkStock(orderId));
            Subtask<Payment> payment = scope.fork(() -> paymentService.processPayment(orderId));

            scope.join();  // Wait for all to complete

            // All three succeeded
            return new OrderSummary(user.get(), inventory.get(), payment.get());

        } // Automatic: if any task failed, all others are cancelled
    }
}

import jdk.incubator.vector.FloatVector;
import jdk.incubator.vector.VectorSpecies;

public class VectorMath {
    // Define the vector size (CPU-dependent: 256-bit = 8 floats)
    private static final VectorSpecies<Float> SPECIES = FloatVector.SPECIES_PREFERRED;

    // Scalar version: processes one element at a time
    public static void scalarAdd(float[] a, float[] b, float[] result) {
        for (int i = 0; i < a.length; i++) {
            result[i] = a[i] + b[i];
        }
    }

    // Vector version: processes 8 elements at a time (SIMD)
    public static void vectorAdd(float[] a, float[] b, float[] result) {
        int i = 0;
        // Process 8 floats at a time
        for (; i < SPECIES.loopBound(a.length); i += SPECIES.length()) {
            FloatVector va = FloatVector.fromArray(SPECIES, a, i);
            FloatVector vb = FloatVector.fromArray(SPECIES, b, i);
            FloatVector vr = va.add(vb);  // Single SIMD instruction
            vr.intoArray(result, i);
        }
        // Handle remaining elements (if array length isn't a multiple of 8)
        for (; i < a.length; i++) {
            result[i] = a[i] + b[i];
        }
    }

    public static void main(String[] args) {
        float[] a = { 1.0f, 2.0f, 3.0f, 4.0f, 5.0f, 6.0f, 7.0f, 8.0f };
        float[] b = { 8.0f, 7.0f, 6.0f, 5.0f, 4.0f, 3.0f, 2.0f, 1.0f };
        float[] result = new float[8];

        scalarAdd(a, b, result);
        System.out.println("Scalar result: " + java.util.Arrays.toString(result));

        vectorAdd(a, b, result);
        System.out.println("Vector result: " + java.util.Arrays.toString(result));

        // Output (both produce the same result):
        // Scalar result: [9.0, 9.0, 9.0, 9.0, 9.0, 9.0, 9.0, 9.0]
        // Vector result: [9.0, 9.0, 9.0, 9.0, 9.0, 9.0, 9.0, 9.0]
    }
}

import jdk.incubator.vector.FloatVector;
import jdk.incubator.vector.VectorSpecies;

public class VectorMath {
    // Define the vector size (CPU-dependent: 256-bit = 8 floats)
    private static final VectorSpecies<Float> SPECIES = FloatVector.SPECIES_PREFERRED;

    // Scalar version: processes one element at a time
    public static void scalarAdd(float[] a, float[] b, float[] result) {
        for (int i = 0; i < a.length; i++) {
            result[i] = a[i] + b[i];
        }
    }

    // Vector version: processes 8 elements at a time (SIMD)
    public static void vectorAdd(float[] a, float[] b, float[] result) {
        int i = 0;
        // Process 8 floats at a time
        for (; i < SPECIES.loopBound(a.length); i += SPECIES.length()) {
            FloatVector va = FloatVector.fromArray(SPECIES, a, i);
            FloatVector vb = FloatVector.fromArray(SPECIES, b, i);
            FloatVector vr = va.add(vb);  // Single SIMD instruction
            vr.intoArray(result, i);
        }
        // Handle remaining elements (if array length isn't a multiple of 8)
        for (; i < a.length; i++) {
            result[i] = a[i] + b[i];
        }
    }

    public static void main(String[] args) {
        float[] a = { 1.0f, 2.0f, 3.0f, 4.0f, 5.0f, 6.0f, 7.0f, 8.0f };
        float[] b = { 8.0f, 7.0f, 6.0f, 5.0f, 4.0f, 3.0f, 2.0f, 1.0f };
        float[] result = new float[8];

        scalarAdd(a, b, result);
        System.out.println("Scalar result: " + java.util.Arrays.toString(result));

        vectorAdd(a, b, result);
        System.out.println("Vector result: " + java.util.Arrays.toString(result));

        // Output (both produce the same result):
        // Scalar result: [9.0, 9.0, 9.0, 9.0, 9.0, 9.0, 9.0, 9.0]
        // Vector result: [9.0, 9.0, 9.0, 9.0, 9.0, 9.0, 9.0, 9.0]
    }
}

import jdk.jfr.Configuration;
import jdk.jfr.FlightRecorder;
import jdk.jfr.Recording;

public class SecureJfrDemo {
    public static void main(String[] args) throws Exception {
        // Start a JFR recording
        Configuration config = Configuration.getConfiguration("default");
        Recording recording = new Recording(config);

        // These values would normally appear in JFR recordings:
        // - Command-line arguments (including secrets)
        // - Environment variables (including API keys)
        // - System properties (including database passwords)

        // With JEP 536, JFR automatically redacts:
        // - Command-line arguments containing sensitive patterns
        // - Environment variables with names like PASSWORD, API_KEY, etc.
        // - System properties containing secrets

        recording.start();

        // Your application runs here...
        // Any sensitive data in JFR recordings is automatically hidden

        recording.stop();

        // The recording can now be safely shared
        // Sensitive values appear as "[REDACTED]" in the output
    }
}

import jdk.jfr.Configuration;
import jdk.jfr.FlightRecorder;
import jdk.jfr.Recording;

public class SecureJfrDemo {
    public static void main(String[] args) throws Exception {
        // Start a JFR recording
        Configuration config = Configuration.getConfiguration("default");
        Recording recording = new Recording(config);

        // These values would normally appear in JFR recordings:
        // - Command-line arguments (including secrets)
        // - Environment variables (including API keys)
        // - System properties (including database passwords)

        // With JEP 536, JFR automatically redacts:
        // - Command-line arguments containing sensitive patterns
        // - Environment variables with names like PASSWORD, API_KEY, etc.
        // - System properties containing secrets

        recording.start();

        // Your application runs here...
        // Any sensitive data in JFR recordings is automatically hidden

        recording.stop();

        // The recording can now be safely shared
        // Sensitive values appear as "[REDACTED]" in the output
    }
}

// Check what JFR is currently recording
jcmd <pid> JFR.dump

// With JEP 536, sensitive data is already redacted
// No additional configuration needed for standard patterns

// Check what JFR is currently recording
jcmd <pid> JFR.dump

// With JEP 536, sensitive data is already redacted
// No additional configuration needed for standard patterns

Java 27 Is Here! What's New?

Java 27 Is Here! What's New?

The Problem

Saad Elattar

Keep reading

A gentle introduction to eBPF: Zero-Code Observability for Java

The End of Reactive? How Java Virtual Threads Are Making Complex Concurrency Simple Again

Security Features

JEP 527 — Post-Quantum Hybrid Key Exchange for TLS 1.3

JEP 538 — PEM Encodings of Cryptographic Objects (Third Preview)

Language Innovation

JEP 532 — Primitive Types in Patterns, instanceof, and switch (Fifth Preview)

Performance Advancements

JEP 523 — Make G1 the Default Garbage Collector Everywhere

GC Types at a Glance

JEP 534 — Compact Object Headers by Default

The Math

Library Improvements

JEP 531 — Lazy Constants (Third Preview)

JEP 533 — Structured Concurrency (Seventh Preview)

The Problem: Unstructured Concurrency

The Solution: Structured Concurrency

JEP 537 — Vector API (12th Incubator)

Tooling

JEP 536 — JFR In-Process Data Redaction

What Gets Redacted

Quick Reference Table

Key Insights

1. Security-First by Default

2. Performance Without Configuration

3. Simpler Concurrency

4. Data Processing Gets Native Speed

Conclusion

Resources