Oracle Delays JDK 27's First Release Candidate by Two Weeks to Align With August Security Patch Cycle
JDK 27's initial release candidate moves from August 6 to August 20 to align with Oracle's Critical Patch Update, shrinking the release's feedback window ahead of a nine-JEP September launch.
Editor's Note ·
- Correction:
- The article quotes Mark Reinhold as saying the release-candidate change was made "due to an increase in frequency of Critical Patch Updates (CPUs)." The cited InfoQ report does not present this as a direct quotation from Reinhold; it is InfoQ's own paraphrase of his announcement, and the source text does not include the word "an" before "increase." The underlying fact — that the schedule change was made because of increasingly frequent Critical Patch Updates — is accurate and supported by the source.
Overview
The initial release candidate for JDK 27 has been pushed back two weeks, from August 6 to August 20, 2026, according to InfoQ. Mark Reinhold, Chief Architect of the Java Platform Group at Oracle, said the change was made “due to an increase in frequency of Critical Patch Updates (CPUs)” and aligns the release candidate with the next scheduled Oracle security patch release on August 18, according to InfoQ.
What We Know
Build 34 of the JDK 27 early-access builds, released the week of the announcement, had originally been intended to serve as the initial release candidate build before the schedule shift, according to InfoQ. Under the original schedule, August 20 had been the target date for JDK 27’s final release candidate, according to InfoWorld — meaning the build once slated to close out the release-candidate phase will now open it instead.
Reinhold acknowledged the compressed timeline shortens the window for developers to report bugs against release-candidate builds. “This reduces the time available for feedback on RC builds by two weeks, from five weeks and four days to three weeks and four days. That does, at least theoretically, increase risk,” he said, according to InfoQ. He added: “Historically, however, since we switched to the six-month cadence in JDK 10 we have needed a second RC build for fewer than half of our releases, and none of the bugs that triggered those builds was reported by an end user. This suggests that the risk is tolerable,” according to InfoQ.
JDK 27 remains on track for a September 14 general availability date, according to InfoQ, and will ship as a non-LTS release with six months of support, according to InfoWorld.
The release carries nine JEPs, according to InfoWorld. JEP 523 makes the G1 collector the default garbage collector across all environments, replacing the JVM’s previous environment-specific defaults, according to InfoQ. JEP 527 adds post-quantum hybrid key exchange for TLS 1.3, combining quantum-resistant and traditional algorithms to defend against future quantum-computing threats, according to InfoWorld.
JEP 534 makes compact object headers the default header layout in HotSpot, cutting headers from 96 bits to 64 bits on 64-bit architectures to shrink heap size and improve deployment density, according to InfoWorld; the feature was originally delivered as an opt-in in JDK 25 via JEP 519, according to InfoQ. JEP 533, Structured Concurrency, reaches its seventh preview, treating related tasks across threads as a single unit of work to improve error handling, cancellation, reliability, and observability, according to InfoWorld.
The remaining JEPs are incremental: JEP 531 (Lazy Constants) reaches its third preview, JEP 532 (primitive types in patterns, instanceof, and switch) its fifth, and JEP 537 (the Vector API) its twelfth incubation round, according to InfoWorld. The Vector API has seen no substantial implementation changes since JDK 25 and will keep incubating until Project Valhalla features arrive as previews, according to InfoQ. JEP 536 adds in-process JFR data redaction, stripping sensitive data such as command-line arguments, environment variables, and system properties before recordings leave the process, and JEP 538 previews PEM encodings for cryptographic keys, certificates, and certificate revocation lists, according to InfoWorld.
What We Don’t Know
Oracle has not said whether the shortened release-candidate feedback window will affect the September general-availability date itself, or whether a second release-candidate build will be needed before launch.
Context
JDK 27 follows JDK 26, which shipped in March with HTTP/3 support and garbage-collector-agnostic AOT caching, as previously reported. As a non-LTS release, JDK 27 is aimed primarily at developers who track the platform’s six-month cadence rather than enterprises on long-term-support versions.