Key:

JDK-X  - https://bugs.openjdk.java.net/browse/JDK-X

CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY

New in release OpenJDK 17.0.1 (2021-10-19):

===========================================

Live versions of these release notes can be found at:

  * https://builds.shipilev.net/backports-monitor/release-notes-17.0.1.txt

* Security fixes

  - JDK-8263314: Enhance XML Dsig modes

  - JDK-8265167, CVE-2021-35556: Richer Text Editors

  - JDK-8265574: Improve handling of sheets

  - JDK-8265580, CVE-2021-35559: Enhanced style for RTF kit

  - JDK-8265776: Improve Stream handling for SSL

  - JDK-8266097, CVE-2021-35561: Better hashing support

  - JDK-8266103: Better specified spec values

  - JDK-8266109: More Resilient Classloading

  - JDK-8266115: More Manifest Jar Loading

  - JDK-8266137, CVE-2021-35564: Improve Keystore integrity

  - JDK-8266689, CVE-2021-35567: More Constrained Delegation

  - JDK-8267086: ArrayIndexOutOfBoundsException in java.security.KeyFactory.generatePublic

  - JDK-8267712: Better LDAP reference processing

  - JDK-8267729, CVE-2021-35578: Improve TLS client handshaking

  - JDK-8267735, CVE-2021-35586: Better BMP support

  - JDK-8268193: Improve requests of certificates

  - JDK-8268199: Correct certificate requests

  - JDK-8268205: Enhance DTLS client handshake

  - JDK-8268500: Better specified ParameterSpecs

  - JDK-8268506: More Manifest Digests

  - JDK-8269618, CVE-2021-35603: Better session identification

  - JDK-8269624: Enhance method selection support

  - JDK-8270398: Enhance canonicalization

  - JDK-8270404: Better canonicalization

* Other changes

  - JDK-8225082: Remove IdenTrust certificate that is expiring in September 2021

  - JDK-8243543: jtreg test security/infra/java/security/cert/CertPathValidator/certification/BuypassCA.java fails

  - JDK-8248899: security/infra/java/security/cert/CertPathValidator/certification/QuoVadisCA.java fails, Certificate has been revoked

  - JDK-8261088: Repeatable annotations without @Target cannot have containers that target module declarations

  - JDK-8262731: [macOS] Exception from "Printable.print" is swallowed during "PrinterJob.print"

  - JDK-8263531: Remove unused buffer int

  - JDK-8266182: Automate manual steps listed in the test jdk/sun/security/pkcs12/ParamsTest.java

  - JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type

  - JDK-8267666: Add option to jcmd GC.heap_dump to use existing file

  - JDK-8268019: C2: assert(no_dead_loop) failed: dead loop detected

  - JDK-8268261: C2: assert(n != __null) failed: Bad immediate dominator info.

  - JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm performance

  - JDK-8268963: [IR Framework] Some default regexes matching on PrintOptoAssembly in IRNode.java do not work on all platforms

  - JDK-8269297: Bump version numbers for JDK 17.0.1

  - JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should be more resilient

  - JDK-8269574: C2: Avoid redundant uncommon traps in GraphKit::builtin_throw() for JVMTI exception events

  - JDK-8269763: The JEditorPane is blank after JDK-8265167

  - JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports incorrect process cpu usage in containers

  - JDK-8269882: stack-use-after-scope in NewObjectA

  - JDK-8269897: Shenandoah: Resolve UNKNOWN access strength, where possible

  - JDK-8269934: RunThese24H.java failed with EXCEPTION_ACCESS_VIOLATION in java_lang_Thread::get_thread_status

  - JDK-8269993: [Test]: java/net/httpclient/DigestEchoClientSSL.java contains redundant @run tags

  - JDK-8270094: Shenandoah: Provide human-readable labels for test configurations

  - JDK-8270096: Shenandoah: Optimize gc/shenandoah/TestRefprocSanity.java for interpreter mode

  - JDK-8270098: ZGC: ZBarrierSetC2::clone_at_expansion fails with "Guard against surprises" assert

  - JDK-8270137: Kerberos Credential Retrieval from Cache not Working in Cross-Realm Setup

  - JDK-8270280: security/infra/java/security/cert/CertPathValidator/certification/LetsEncryptCA.java  OCSP response error

  - JDK-8270344: Session resumption errors

  - JDK-8271203: C2: assert(iff->Opcode() == Op_If || iff->Opcode() == Op_CountedLoopEnd || iff->Opcode() == Op_RangeCheck) failed: Check this code when new subtype is added

  - JDK-8271276: C2: Wrong JVM state used for receiver null check

  - JDK-8271335: Updating RE Configs for BUILD REQUEST 17.0.1+4

  - JDK-8271589: fatal error with variable shift count integer rotate operation.

  - JDK-8271723: Unproblemlist runtime/InvocationTests/invokevirtualTests.java

  - JDK-8271730: Client authentication using RSASSA-PSS fails after correct certificate requests

  - JDK-8271925: ZGC: Arraycopy stub passes invalid oop to load barrier

  - JDK-8272124: Cgroup v1 initialization causes NullPointerException when cgroup path contains colon

  - JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash when clone null CallProjections.fallthrough_ioproj

  - JDK-8272326: java/util/Random/RandomTestMoments.java had two Gaussian fails

  - JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz after JDK-8255790

  - JDK-8272472: StackGuardPages test doesn't build with glibc 2.34

  - JDK-8272581: sun/security/pkcs11/Provider/MultipleLogins.sh fails after JDK-8266182

  - JDK-8272602: [macos] not all KEY_PRESSED events sent when control modifier is used

  - JDK-8272700: [macos] Build failure with Xcode 13.0 after JDK-8264848

  - JDK-8272708: [Test]: Cleanup: test/jdk/security/infra/java/security/cert/CertPathValidator/certification/BuypassCA.java no longer needs ocspEnabled

  - JDK-8272806: [macOS] "Apple AWT Internal Exception" when input method is changed

  - JDK-8273358: macOS Monterey does not have the font Times needed by Serif

Notes on individual issues:

===========================

security-libs/java.security:

JDK-8271434: Removed IdenTrust Root Certificate

===============================================

The following root certificate from IdenTrust has been removed from

the `cacerts` keystore:

Alias Name: identrustdstx3 [jdk]

Distinguished Name: CN=DST Root CA X3, O=Digital Signature Trust Co.

New in release OpenJDK 17.0.0 (2021-09-14):

===========================================

The full list of changes in the interim releases from 11u to 17u can be found at:

  * https://builds.shipilev.net/backports-monitor/release-notes-12.txt

  * https://builds.shipilev.net/backports-monitor/release-notes-13.txt

  * https://builds.shipilev.net/backports-monitor/release-notes-14.txt

  * https://builds.shipilev.net/backports-monitor/release-notes-15.txt

  * https://builds.shipilev.net/backports-monitor/release-notes-16.txt

  * https://builds.shipilev.net/backports-monitor/release-notes-17.txt

Major changes are listed below.  Some changes may have been backported

to earlier releases following their first appearance in OpenJDK 12

through to 17.

NEW FEATURES

============

Language Features

=================

Switch Expressions

==================

https://openjdk.java.net/jeps/325

https://openjdk.java.net/jeps/354

https://openjdk.java.net/jeps/361

Extend the `switch` statement so that it can be used as either a

statement or an expression, and that both forms can use either a

"traditional" or "simplified" scoping and control flow behavior.  Both

forms can use either traditional `case ... :` labels (with fall

through) or new `case ... ->` labels (with no fall through), with a

further new statement for yielding a value from a `switch`

expression. These changes will simplify everyday coding, and also

prepare the way for the use of pattern matching in `switch`.

This was a preview feature (http://openjdk.java.net/jeps/12) in

OpenJDK 12 & 13 and became final in OpenJDK 14.

Text Blocks

===========

https://openjdk.java.net/jeps/355

https://openjdk.java.net/jeps/368

https://openjdk.java.net/jeps/378

Add text blocks to the Java language. A text block is a multi-line

string literal that avoids the need for most escape sequences,

automatically formats the string in a predictable way, and gives the

developer control over format when desired.

This was a preview feature (http://openjdk.java.net/jeps/12) in

OpenJDK 13 & 14 and became final in OpenJDK 15.

Pattern Matching for instanceof

===============================

https://openjdk.java.net/jeps/305

https://openjdk.java.net/jeps/375

https://openjdk.java.net/jeps/394

http://cr.openjdk.java.net/~briangoetz/amber/pattern-match.html

Enhance the Java programming language with pattern matching for the

`instanceof` operator. Pattern matching allows common logic in a

program, namely the conditional extraction of components from objects,

to be expressed more concisely and safely.

This was a preview feature (http://openjdk.java.net/jeps/12) in

OpenJDK 14 & 15 and became final in OpenJDK 16.

Records

=======

https://openjdk.java.net/jeps/359

https://openjdk.java.net/jeps/384

https://openjdk.java.net/jeps/395

Enhance the Java programming language with records.  Records provide a

compact syntax for declaring classes which are transparent holders for

shallowly immutable data.

This was a preview feature (http://openjdk.java.net/jeps/12) in

OpenJDK 14 & 15 and became final in OpenJDK 16.

Sealed Classes

==============

https://openjdk.java.net/jeps/360

https://openjdk.java.net/jeps/397

https://openjdk.java.net/jeps/409

https://cr.openjdk.java.net/~briangoetz/amber/datum.html

Enhance the Java programming language with sealed classes and

interfaces. Sealed classes and interfaces restrict which other classes

or interfaces may extend or implement them.

This was a preview feature (http://openjdk.java.net/jeps/12) in

OpenJDK 15 & 16 and became final in OpenJDK 17.

Restore Always-Strict Floating-Point Semantics

==============================================

https://openjdk.java.net/jeps/306

Make floating-point operations consistently strict, rather than have

both strict floating-point semantics (`strictfp`) and subtly different

default floating-point semantics. This will restore the original

floating-point semantics to the language and VM, matching the

semantics before the introduction of strict and default floating-point

modes in Java SE 1.2.

Pattern Matching for switch

===========================

https://openjdk.java.net/jeps/406

Enhance the Java programming language with pattern matching for

`switch` expressions and statements, along with extensions to the

language of patterns. Extending pattern matching to `switch` allows an

expression to be tested against a number of patterns, each with a

specific action, so that complex data-oriented queries can be

expressed concisely and safely.

This is a preview feature (http://openjdk.java.net/jeps/12) in OpenJDK

17.

Library Features

================

JVM Constants API

=================

https://openjdk.java.net/jeps/334

Introduce an API to model nominal descriptions of key class-file and

run-time artifacts, in particular constants that are loadable from the

constant pool.

Reimplement the Legacy Socket API

=================================

https://openjdk.java.net/jeps/353

Replace the underlying implementation used by the `java.net.Socket`

and `java.net.ServerSocket` APIs with a simpler and more modern

implementation that is easy to maintain and debug. The new

implementation will be easy to adapt to work with user-mode threads,

a.k.a. fibers, currently being explored in Project Loom

(https://openjdk.java.net/projects/loom).

JFR Event Streaming

===================

https://openjdk.java.net/jeps/349

Expose JDK Flight Recorder data for continuous monitoring.

Non-Volatile Mapped Byte Buffers

================================

https://openjdk.java.net/jeps/352

Add new JDK-specific file mapping modes so that the `FileChannel` API

can be used to create `MappedByteBuffer` instances that refer to

non-volatile memory.

Helpful NullPointerExceptions

=============================

https://openjdk.java.net/jeps/358

Improve the usability of `NullPointerException`s generated by the JVM

by describing precisely which variable was `null`.

Foreign-Memory Access API

=========================

https://openjdk.java.net/jeps/370

https://openjdk.java.net/jeps/383

https://openjdk.java.net/jeps/393

Introduce an API to allow Java programs to safely and efficiently

access foreign memory outside of the Java heap.

This was a incubation feature (https://openjdk.java.net/jeps/11) in

OpenJDK 14, 15 & 16, now superseded by the Foreign Function & Memory

API in OpenJDK 17 (see below).

Edwards-Curve Digital Signature Algorithm (EdDSA)

=================================================

https://openjdk.java.net/jeps/339

Implement cryptographic signatures using the Edwards-Curve Digital

Signature Algorithm (EdDSA) as described by RFC 8032

(https://tools.ietf.org/html/rfc8032).

Hidden Classes

==============

https://openjdk.java.net/jeps/371

Introduce hidden classes, which are classes that cannot be used

directly by the bytecode of other classes. Hidden classes are intended

for use by frameworks that generate classes at run time and use them

indirectly, via reflection. A hidden class may be defined as a member

of an access control nest (https://openjdk.java.net/jeps/181), and may

be unloaded independently of other classes.

Reimplement the Legacy DatagramSocket API

=========================================

https://openjdk.java.net/jeps/373

Replace the underlying implementations of the

`java.net.DatagramSocket` and `java.net.MulticastSocket` APIs with

simpler and more modern implementations that are easy to maintain and

debug. The new implementations will be easy to adapt to work with

virtual threads, currently being explored in Project Loom

(https://openjdk.java.net/projects/loom). This is a follow-on to JEP

353 (see above), which already reimplemented the legacy Socket API.

Vector API

==========

https://openjdk.java.net/jeps/338

https://openjdk.java.net/jeps/414

Provide an initial iteration of an incubator module,

`jdk.incubator.vector`, to express vector computations that reliably

compile at runtime to optimal vector hardware instructions on

supported CPU architectures and thus achieve superior performance to

equivalent scalar computations.

This is an incubation feature (https://openjdk.java.net/jeps/11)

introduced in OpenJDK 16.

Unix-Domain Socket Channels

===========================

https://openjdk.java.net/jeps/380

Add Unix-domain (`AF_UNIX`) socket support to the socket channel and

server-socket channel APIs in the `java.nio.channels` package. Extend

the inherited channel mechanism to support Unix-domain socket channels

and server socket channels.

Foreign Linker API (Incubator)

==============================

https://openjdk.java.net/jeps/389

Introduce an API that offers statically-typed, pure-Java access to

native code. This API, together with the Foreign-Memory API (see

above), will considerably simplify the otherwise error-prone process

of binding to a native library.

This was an incubation feature (https://openjdk.java.net/jeps/11)

introduced in OpenJDK 16, now superseded by the Foreign Function &

Memory API in OpenJDK 17 (see below).

Strongly Encapsulate JDK Internals by Default

=============================================

https://openjdk.java.net/jeps/396

https://openjdk.java.net/jeps/403

Strongly encapsulate all internal elements of the JDK by default,

except for critical internal APIs such as `sun.misc.Unsafe`.  It will

no longer be possible to relax the strong encapsulation of internal

elements via a single command-line option, as was possible in OpenJDK

9 through 16.

Enhanced Pseudo-Random Number Generators

========================================

https://openjdk.java.net/jeps/356

Provide new interface types and implementations for pseudo-random

number generators (PRNGs), including jumpable PRNGs and an additional

class of splittable PRNG algorithms (LXM).

Foreign Function & Memory API

=============================

https://openjdk.java.net/jeps/412

Introduce an API by which Java programs can interoperate with code and

data outside of the Java runtime. By efficiently invoking foreign

functions (i.e., code outside the JVM), and by safely accessing

foreign memory (i.e., memory not managed by the JVM), the API enables

Java programs to call native libraries and process native data without

the brittleness and danger of JNI.

This API is an incubation feature (https://openjdk.java.net/jeps/11)

introduced in OpenJDK 17, and is an evolution of the Foreign Memory

Access API (OpenJDK 14 through 16) and Foreign Linker API (OpenJDK

16) (see above).

Context-Specific Deserialization Filters

========================================

https://openjdk.java.net/jeps/415

Allow applications to configure context-specific and

dynamically-selected deserialization filters via a JVM-wide filter

factory that is invoked to select a filter for each individual

deserialization operation.

Tools

=====

Packaging Tool

==============

https://openjdk.java.net/jeps/343

https://openjdk.java.net/jeps/392

Provide the `jpackage` tool, for packaging self-contained Java

applications.

JVM Features

============

Shenandoah: A Low-Pause-Time Garbage Collector

==============================================

https://openjdk.java.net/jeps/189

https://openjdk.java.net/jeps/379

Add a new garbage collection (GC) algorithm named Shenandoah which

reduces GC pause times by doing evacuation work concurrently with the

running Java threads.  Pause times with Shenandoah are independent of

heap size, meaning you will have the same consistent pause times

whether your heap is 200 MB or 200 GB.

Shenandoah has been provided in Red Hat builds of OpenJDK 8 since

8u131 in April 2017 and in all 11u builds.

Upstream, it was introduced in OpenJDK 12 as an experimental feature

and became a production feature in OpenJDK 15. It was backported to

OpenJDK 11 with the 11.0.9 release in October 2020.

Abortable Mixed Collections for G1

==================================

https://openjdk.java.net/jeps/344

Make G1 mixed collections abortable if they might exceed the pause

target.

Promptly Return Unused Committed Memory from G1

===============================================

https://openjdk.java.net/jeps/346

Enhance the G1 garbage collector to automatically return Java heap

memory to the operating system when idle.

Dynamic CDS Archives

====================

https://openjdk.java.net/jeps/310

https://openjdk.java.net/jeps/350

Extend application class-data sharing to allow the dynamic archiving

of classes at the end of Java application execution. The archived

classes will include all loaded application classes and library

classes that are not present in the default, base-layer CDS archive.

ZGC: Uncommit Unused Memory (Experimental)

==========================================

https://openjdk.java.net/jeps/351

Enhance ZGC to return unused heap memory to the operating system.

NUMA-Aware Memory Allocation for G1

===================================

https://openjdk.java.net/jeps/345

Improve G1 performance on large machines by implementing NUMA-aware

memory allocation.

ZGC on macOS (Experimental)

===========================

https://openjdk.java.net/jeps/364

Port the ZGC garbage collector to macOS.

ZGC on Windows (Experimental)

=============================

https://openjdk.java.net/jeps/365

Port the ZGC garbage collector to Windows.

ZGC: A Scalable Low-Latency Garbage Collector (Production)

==========================================================

https://openjdk.java.net/jeps/377

Change the Z Garbage Collector from an experimental feature into a

product feature.

ZGC: Concurrent Thread-Stack Processing

=======================================

https://openjdk.java.net/jeps/376

Move ZGC thread-stack processing from safepoints to a concurrent

phase.

Elastic Metaspace

=================

https://openjdk.java.net/jeps/387

Return unused HotSpot class-metadata (i.e., metaspace) memory to the

operating system more promptly, reduce metaspace footprint, and

simplify the metaspace code in order to reduce maintenance costs.

Ports

=====

Alpine Linux Port

=================

https://openjdk.java.net/jeps/386

Port the JDK to Alpine Linux, and to other Linux distributions that

use musl as their primary C library, on both the x64 and AArch64

architectures,

Windows/AArch64 Port

====================

https://openjdk.java.net/jeps/388

Port the JDK to Windows/AArch64.

New macOS Rendering Pipeline

============================

https://openjdk.java.net/jeps/382

Implement a Java 2D internal rendering pipeline for macOS using the

Apple Metal API as alternative to the existing pipeline, which uses

the deprecated Apple OpenGL API.

macOS/AArch64 Port

==================

https://openjdk.java.net/jeps/391

Port the JDK to macOS/AArch64.

DEPRECATIONS

============

Deprecate the ParallelScavenge + SerialOld GC Combination

=========================================================

https://openjdk.java.net/jeps/366

Deprecate the combination of the Parallel Scavenge and Serial Old

garbage collection algorithms.

Deprecate and Disable Biased Locking

====================================

https://openjdk.java.net/jeps/374

Disable biased locking by default, and deprecate all related

command-line options.

Warnings for Value-Based Classes

================================

https://openjdk.java.net/jeps/390

Designate the primitive wrapper classes as value-based and deprecate

their constructors for removal, prompting new deprecation

warnings. Provide warnings about improper attempts to synchronize on

instances of any value-based classes in the Java Platform.

Deprecate the Applet API for Removal

====================================

https://openjdk.java.net/jeps/398

Deprecate the Applet API for removal.  It is essentially irrelevant

since all web-browser vendors have either removed support for Java

browser plug-ins or announced plans to do so.

Deprecate the Security Manager for Removal

==========================================

https://openjdk.java.net/jeps/411

Deprecate the Security Manager for removal in a future release. The

Security Manager dates from Java 1.0. It has not been the primary

means of securing client-side Java code for many years, and it has

rarely been used to secure server-side code. To move Java forward, we

intend to deprecate the Security Manager for removal in concert with

the legacy Applet API (see above).  .

REMOVALS

========

Remove the Concurrent Mark Sweep (CMS) Garbage Collector

========================================================

https://openjdk.java.net/jeps/363

Remove the Concurrent Mark Sweep (CMS) garbage collector.

Remove the Pack200 Tools and API

================================

https://openjdk.java.net/jeps/336

https://openjdk.java.net/jeps/367

Remove the `pack200` and `unpack200` tools, and the `Pack200` API in

the `java.util.jar` package.  These tools and API were deprecated for

removal in OpenJDK 11 with the express intent to remove them in a

future release.

Remove the Nashorn JavaScript Engine

====================================

https://openjdk.java.net/jeps/372

Remove the Nashorn JavaScript script engine and APIs, and the `jjs`

tool. The engine, the APIs, and the tool were deprecated for removal

in OpenJDK 11 with the express intent to remove them in a future

release.

Remove the Solaris and SPARC Ports

==================================

https://openjdk.java.net/jeps/362

https://openjdk.java.net/jeps/381

Remove the source code and build support for the Solaris/SPARC,

Solaris/x64, and Linux/SPARC ports.  These ports were deprecated for

removal in OpenJDK 14 (JEP 362) and removed in OpenJDK 15 (JEP 381).

Remove RMI Activation

=====================

https://openjdk.java.net/jeps/385

https://openjdk.java.net/jeps/407

https://docs.oracle.com/en/java/javase/14/docs/specs/rmi/activation.html

Remove the Remote Method Invocation (RMI) Activation mechanism, while

preserving the rest of RMI.  RMI Activation is an obsolete part of RMI

that has been optional since OpenJDK 8 and was deprecated in OpenJDK

15.

Remove the Experimental AOT and JIT Compiler

============================================

https://openjdk.java.net/jeps/410

Remove the experimental Java-based ahead-of-time (AOT) and

just-in-time (JIT) compiler.  This compiler has seen little use since

its introduction and the effort required to maintain it is

significant.  Retain the experimental Java-level JVM compiler

interface (JVMCI) so that developers can continue to use

externally-built versions of the compiler for JIT compilation.