Article originally posted on InfoQ. Visit InfoQ

This week’s Java roundup for March 27th, 2023 features news from OpenJDK, JDK 21, GlassFish 7.0.3, Spring point and milestone releases, Payara Platform, Quarkus 3.0.CR1, Micronaut 3.8.8, WildFly 28 Beta1, Hibernate ORM 6.2, Groovy 4.0.11, Camel 3.20.3, James 3.7.4, Eclipse Vert.x 4.4.1, JHipster Quarkus Blueprint 2.0, JHipster Lite 0.30, JBang 0.106, Gradle 8.1-CR2 and new Foojay.io calendar.

OpenJDK

The results of the 2023 Governing Board Election show that Andrew Haley, technical lead, Open Source Java at Red Hat, and Phil Race, consulting member of technical staff at Oracle, have been elected to the board to fill the two At-Large member seats. They will serve a term of one calendar year effective April 1, 2023. InfoQ will follow up with a more detailed news story.

JEP 444, Virtual Threads, was promoted from its JEP Draft 8303683 to Candidate status, then quickly promoted from Candidate to Proposed to Target status for JDK 21. This JEP proposes to finalize this feature based on feedback from the previous two rounds of preview: JEP 436, Virtual Threads (Second Preview), delivered in JDK 20; and JEP 425, Virtual Threads (Preview), delivered in JDK 19. This feature provides virtual threads, lightweight threads that dramatically reduce the effort of writing, maintaining, and observing high-throughput concurrent applications, to the Java platform. The most significant change from JEP 436 is that virtual threads now fully support thread-local variables by eliminating the option to opt-out of using these variables. More details on JEP 425 may be found in this InfoQ news story and this JEP Café screen cast by José Paumard, Java developer advocate, Java Platform Group at Oracle. The review is expected to conclude on April 7, 2023.

Version 7.2 of the Regression Test Harness for the JDK, jtreg, has been released and ready for integration in the JDK. The most significant new feature is the ability to run tests using virtual threads. Further details on this release may be found in the release notes.

JDK 21

Build 16 of the JDK 21 early-access builds was made available this past week featuring updates from Build 15 that include fixes to various issues. More details on this build may be found in the release notes.

Mark Reinhold, chief architect, Java Platform Group at Oracle, formally proposed the release schedule for JDK 21 as follows:

• Rampdown Phase One (fork from main line): June 8, 2023
• Rampdown Phase Two: July 20, 2023
• Initial Release Candidate: August 10, 2023
• Final Release Candidate: August 24, 2023
• General Availability: September 19, 2023

For JDK 21, developers are encouraged to report bugs via the Java Bug Database.

GlassFish

The release of GlassFish 7.0.3 ships with bug fixes, improvements in documentation and dependency upgrades such as: Mojarra 4.0.2, EclipseLink 4.0.1, Helidon Config 3.2.0 and ASM 9.5. Further details on this release may be found in the release notes.

Spring Framework

The Spring Integration team has announced that the Spring Integration Extension for Amazon Web Services (AWS), version 3.0.0-M2, and Spring Cloud Stream Binder for AWS Kinesis, version 4.0.0-M1, projects have been moved to the AWS Java SDK. Notable changes in each of these milestone releases include: AWS Java SDK 2.20.32, the latest version; a dependency upgrade to Spring Cloud AWS 3.0.0 with the new SQS listener API; a DynamoDbLockRegistry class, an implementation of the ExpirableLockRegistry and RenewableLockRegistry interfaces, to provide proper TTL support; and removal of XML configuration.

Spring Cloud 2022.0.2, codenamed Kilburn, has been released featuring updates to sub-projects such as: Spring Cloud Vault 4.0.1, Spring Cloud Kubernetes 3.0.2, Spring Cloud OpenFeign 4.0.2 and Spring Cloud Config 4.0.2. There are, however, breaking changes with the removal of sub-projects: Spring Cloud CLI, Spring Cloud for Cloud Foundry and Spring Cloud Sleuth. More details on this release may be found in the release notes.

The first release candidate of Spring Web Flow 3.0.0 delivers new features: a migration of Spring Faces to Spring Framework 6, Jakarta EE, and JSF 4; and an update of the JSF samples to Jakarta EE. Further details on this release may be found in the release notes.

Payara

Payara has released their March 2023 edition of the Payara Platform that includes Community Edition 6.2023.3, Enterprise Edition 5.49.0 and the formal release of Payara Enterprise 6.0. All of these editions now support Jakarta EE 10 and MicroProfile 6.0. It is important to note that a known issue is currently being investigated: when deploying an application that contains a Java Record, a warning is logged in the server logs about Records not being supported. The Payara team assures that an application will still deploy and operate as expected.

Community Edition 6.2023.3 delivers bug fixes, component upgrades and improvements such as: an update to the REST SSL alias extension for Payara 6; upgrade the cacerts.jks and keystore.jks certificates to PKCS#12; and configure all SameSite cookie attributes for an HTTP network listener. More details on this release may be found in the release notes.

Enterprise Edition 5.49.0 also ships with bug fixes, component upgrades and the same SameSite cookie improvement as noted in the Community Edition. Further details on this release may be found in the release notes.

The Payara team has also published CVE-2023-28462, a vulnerability affecting server environments running on JDK 8 on updates lower than version 1.8u191. This vulnerability allows a remote attacker to load malicious code into a public-facing Payara Server installation using remote JNDI access via unsecured object request broker (ORB) listeners. Developers are encouraged to install a version of JDK 8 higher than 1.8u191.

Quarkus

After six alpha releases and one beta release, the first release candidate of Quarkus 3.0.0 was made available to the Java community this past week. New features include: introduce an initial version of the non-application root path, /q/info, endpoint; use SmallRye BeanBag to initialize the Maven RepositorySystem interface for compatibility with Maven 3.9; and a new plugin mechanism for the Quarkus CLI. More details on this release may be found in the release notes.

Micronaut

The Micronaut Foundation has released Micronaut Framework 3.8.8 featuring bug fixes and updates to modules: Micronaut Data, Micronaut Views, Micronaut OpenAPI, Micronaut Security and Micronaut Maven Plugin. There was also a dependency upgrade to Netty 4.1.90. Further details on this release may be found in the release notes.

WildFly

The first beta release of WildFly 28 delivers new features such as: support for Micrometer that includes integration of Micrometer with their implementation of MicroProfile Fault Tolerance specification; and support for the MicroProfile Telemetry and MicroProfile Long Running Actions (LRA) specifications. There was also a removal of support for the MicroProfile Metrics and MicroProfile OpenTracing specifications. More details on this release may be found in the release notes.

Hibernate

After four release candidates, the formal release of Hibernate ORM 6.2 delivers support for: structured SQL types; Java records; unified generated persisted values; database partitions; proprietary SQL types; and the ability to use the SQL MERGE command to handle updates against optional tables.

Apache Software Foundation

Paul King, principal software engineer at Object Computing, Inc., director at ASERT and vice president at Apache Groovy, has announced three point releases of Apache Groovy as described below. Developers should expect fewer point releases in the 3.0 and 2.0 release trains as the team will be focusing on Groovy 5.0.

Version 4.0.11 delivers bug fixes and new features such as: new methods, asReversed() and reverseEach(), that will map directly to the descendingSet() and descendingIterator() methods, respectively, defined in the NavigableSet interface; a dependency upgrade to ASM 9.5; and a new constant for JDK 21. Further details on this release may be found in the changelog.

Version 3.0.17 features bug fixes, improvements in documentation and a dependency upgrade to ASM 9.5. More details on this release may be found in the changelog.

Similarly, version 2.5.22 features bug fixes, improvements in documentation and a dependency upgrade to ASM 9.5. Further details on this release may be found in the changelog.

The release of Apache Camel 3.20.3 provides bug fixes, dependency upgrades and new features/improvements such as: add health checks for components that have an extension for connectivity verification (camel-health); a user configuration file in the camel-jbang component; and favor instances of the CompositeMeterRegistry class in the Camel Registry API. More details on this release may be found in the release notes.

The release of Apache James 3.7.4 addresses CVE-2023-26269, Privilege Escalation through Unauthenticated JMX, a vulnerability in which versions of Apache James Server 3.7.3 and earlier provides a JMX management service without authentication by default that would allow an attacker to have access to privilege escalation. Further details on this release may be found in the release notes.

Eclipse Vert.x

Eclipse Vert.x 4.4.1 has been released with bug fixes and dependency upgrades to GraphQL-Java 20.1, Netty 4.1.90, SnakeYAML 2.0, Micrometer 1.10.5 and Apache Qpid Proton-J 0.34.1. More details on this release may be found in the release notes and deprecations and breaking changes.

JHipster

The JHipster team has released version 2.0.0 of the JHipster Quarkus Blueprint with notable changes such as: fix OIDC settings for the production profile; update the blueprint dependencies and Quarkus to 2.16.2; fix Keycloak authorization and Cypress tests; and a fix for the SQL Docker images. Further details on this release may be found in the release notes.

The JHipster team has also released JHipster Lite 0.30.0 features bug fixes, dependency upgrades and enhancements such as: remove a duplicated JSON Web Token dependency; a new getUsername() method to the ApplicationAuthorizations class; and a fix for the Angular OAuth2 with Keycloak. More details on this release may be found in the release notes.

JBang

Version 0.106.0 and 0.106.1 of JBang introduces support for the use of GPT in the jbang init command by calling the ChatGPT API to initialize and create a jbang script that attempts to execute the string that is expressed on the command line. Further details on this new feature may be found in this YouTube video and InfoQ will follow up with a more detailed news story.

Gradle

The second release candidate of Gradle 8.1 provides: continued improvements to the configuration cache; support for dependency verification; improved error reporting for Groovy closures; support for Java lambdas; and support for building projects with JDK 20. More details on this release may be found in the release notes.

Foojay.io

Foojay.io, the Friends of OpenJDK resource for Java developers, have provided their Java community calendar for developers to view and add events. The calendar is open for adding content without the need for a special account and the content is moderated.