Java News Roundup: Shenandoah GC, TeamCity CVE, A2A Java SDK, Camel

Open the source listing →

The Java ecosystem saw updates across OpenJDK, enterprise frameworks, agentic AI protocols, and developer tooling for the week of August 3rd, 2026, as detailed in InfoQ's report. Key highlights include JEP 535 targeting JDK 28 to make Generational Shenandoah GC the default mode, scheduling adjustments for the JDK 27 initial release candidate, point releases for GlassFish and Gradle, and critical security guidance addressing an actively exploited TeamCity vulnerability.

This roundup provides developers and software architects with a structured breakdown of official platform changes, library milestones, and security patches. It covers early-access build updates for JDK 27 and JDK 28, new features in GlassFish 8.0.4, agent protocol implementations in A2A Java SDK 1.2.0, AI integration tools in Apache Camel 4.22.0, build optimizations in Gradle 9.7.0, and the fifth milestone of Apache Grails 8.0.0.

The offer: Java News Roundup

OpenJDK advancements lead the week's announcements with JEP 535 moving from Proposed to Target to Targeted status for JDK 28. This proposal designates the Shenandoah Garbage Collector to operate in generational mode by default, while deprecating the non-generational mode for future removal. Meanwhile, JDK 27 early-access Build 34 and JDK 28 early-access Build 10 were both published with stability fixes. Oracle Chief Architect Mark Reinhold announced a shift in the initial release candidate date for JDK 27 from August 6, 2026, to August 20, 2026, aligning with the August 18 Critical Patch Update release. Reinhold noted this reduces the RC feedback window from five weeks and four days to three weeks and four days, though historical data shows second RC builds were needed in fewer than half of releases since switching to the six-month cadence.

Enterprise runtimes and framework releases introduced both feature additions and critical security updates. GlassFish 8.0.4 addresses deserialization flaws CVE-2026-59889 and CVE-2026-54515 in Jackson Databind, along with CVE-2026-12605, a vulnerability in DownloadServlet allowing unauthenticated domain takeover via a leaked gfresttoken. In build systems, Gradle 9.7.0 promoted Isolated Projects to incubating status and enhanced Configuration Cache mechanisms. JetBrains issued updated guidance on CVE-2026-63077, confirming active exploitation of unpatched TeamCity servers and urging upgrades to version 2025.11.7 or 2026.1.3, or installation of a standalone security patch plugin for versions 2017.1+.

How to get Java News Roundup

Developers can access early-access builds of JDK 27 Build 34 and JDK 28 Build 10 directly through the official OpenJDK download mirrors. GlassFish 8.0.4 is available via standard Eclipse Foundation distribution channels and Maven repositories, incorporating patch fixes for AutoDeployer and FileArchive classes alongside updated JNDI lookup diagnostics. Apache Grails 8.0.0 Milestone 5 can be fetched through the project repository, featuring refactored transformation handling in GlobalGrailsClassInjectorTransformation and stack trace filtering updates in GrailsUtil.

For AI integration and agent architectures, A2A Java SDK 1.2.0 is published for Java environments implementing the Agent2Agent Protocol, adding non-CDI authorization reuse and the TaskStreamLifecycleHook interface. Apache Camel 4.22.0 can be integrated via Maven dependencies, introducing camel-ai-tool for framework discovery and camel-mcp-server for turning Camel routes into Model Context Protocol tools. JetBrains TeamCity server administrators can obtain fixed binaries 2025.11.7 and 2026.1.3 via JetBrains download portals, while legacy deployments on version 2017.1 or higher can download a standalone ZIP security patch plugin.

How Java News Roundup compares

The shift of Shenandoah GC to generational mode by default in JDK 28 highlights a industry-wide effort toward reducing pause times and memory footprints without manual tuning. Comparing JDK release cadences, the decision to delay the JDK 27 initial release candidate by two weeks to align with the August 18 CPU release demonstrates Oracle prioritizing patch synchronization over the full five-week feedback window. Reinhold emphasized that end users historically have not reported the bugs prompting secondary RC builds, supporting the decision to adopt a shortened feedback period of three weeks and four days.

In application framework ecosystems, Apache Camel 4.22.0 distinguishes itself by targeting direct Model Context Protocol compatibility via camel-mcp-server, allowing standard routing definitions to expose MCP tools automatically. A2A Java SDK 1.2.0 expands agentic application control compared to prior releases by introducing StreamCloseHandle and explicit control over ChildQueue instances within EventQueue. In project build tooling, Gradle 9.7.0 advances project isolation state beyond initial experimentation into incubating status while adding documentation mechanisms for trusted PGP keys and signing key rotation.

Who should buy Java News Roundup

Engineering leads and system administrators managing JetBrains TeamCity deployments must prioritize immediate evaluation of CVE-2026-63077. Because active exploitation attempts are confirmed against exposed servers, infrastructure teams running unpatched versions must update immediately to 2025.11.7 or 2026.1.3, or apply the ZIP patch plugin to maintain server integrity. Similarly, teams operating GlassFish application servers should deploy version 8.0.4 to neutralize the critical unauthenticated domain takeover threat stemming from gfresttoken leakage in DownloadServlet.

Java platform developers building agentic AI applications or adopting Model Context Protocol interfaces will find relevant infrastructure upgrades in A2A Java SDK 1.2.0 and Apache Camel 4.22.0. Development teams preparing for future Java long-term support alignment should evaluate JDK 27 Build 34 and test generational Shenandoah GC behavior under JDK 28 Build 10 to identify potential garbage collection performance gains early.

The catch with Java News Roundup

The primary operational risk highlighted in this week's news surrounds unpatched TeamCity servers facing active HTTP(S) authentication bypass exploitation under CVE-2026-63077. Organizations unable to upgrade immediately must manage manual application of the standalone security patch plugin across legacy installations. For GlassFish users, failure to update to 8.0.4 leaves administrative control domains vulnerable to full unauthenticated compromise via exposed rest tokens.

Additionally, the schedule modification for JDK 27 compresses the initial release candidate testing window by two full weeks. Development teams relying on the early RC phase for internal regression testing must condense their validation cycles to three weeks and four days before general release. In runtime performance tuning, existing deployments utilizing non-generational Shenandoah GC face future refactoring requirements as non-generational mode enters formal deprecation under JEP 535.