# Java Ecosystem Update: JDK 28 JEPs and Security Patches Key updates include JDK 28 feature targets, Azul Payara releases, and critical Apache Camel security fixes. - **Source:** [InfoQ](https://brifing.si/source/68ac18af-a4f3-4f7c-9c2c-44d4af8f89dd) - **Published:** 2026-10-19 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/c261a3b7-03d3-4558-8bc8-a2b3558afca9 ## JDK 28 Development Progress The OpenJDK project has officially targeted three key JEPs for the upcoming JDK 28 release. These include adaptive heap sizing for ZGC, faster startup and warmup capabilities, and the finalization of structured concurrency. Build 20 of the early-access release is currently available, incorporating various fixes and refinements from the previous build iteration. ## ZGC Enhancements for Performance JEP 546 and JEP 545 focus on optimizing the Z Garbage Collector. Adaptive heap sizing allows the JVM to dynamically adjust memory based on resource availability and neighboring application demands. Meanwhile, faster startup improvements enable more efficient physical memory acquisition, significantly reducing the time required for applications to reach their peak operational performance. ## Structured Concurrency Finalization After seven preview rounds and two incubator phases, structured concurrency is now finalized for JDK 28. This feature treats related tasks as a single unit of work, which simplifies error handling and cancellation processes. By improving observability and reliability, it streamlines concurrent programming patterns for developers managing complex, multi-threaded Java application architectures. ## Azul Payara October Updates Azul Payara version 7.5.0 introduces updates across Community and Enterprise editions. Key changes include removing elevated permission requirements for SSH nodes and adding new command-line properties like delete-jvm-option. These configuration management improvements aim to simplify deployment workflows for architects, while component upgrades ensure better compatibility and stability across different enterprise environments. ## Gatherers4j and Yupiik Fusion Gatherers4j 0.15.0 adds statistical gatherers such as movingWeightedMean and runningStatistics, providing enhanced data processing capabilities. Concurrently, Yupiik Fusion 1.2.0 updates its CLI documentation generator and modifies the HandlebarsCompiler class. These releases focus on improving developer tooling and internal API consistency, requiring users to review breaking changes before upgrading their existing project dependencies. ## Google ADK Feature Expansion The ADK for Java 1.12.0 refactors ContextCacheConfig and introduces new workflow graph types like BaseNode and Edge. Simultaneously, ADK for Kotlin 1.4.0 adds an EdgesDsl class and a ChatCompletions backend for OpenAI API compatibility. These updates provide more robust abstractions for building complex workflow graphs and integrating modern generative AI model endpoints. ## Critical Apache Camel Security The Apache Camel team resolved 38 CVEs, with 13 rated as high severity and 25 as medium. Project Glasswing identified 28 of these vulnerabilities, while researchers reported the remaining 10. Developers must upgrade to versions 4.23.0, 4.22.1, or 4.18.5 immediately to mitigate these security risks across their integrated Camel components. ## Architectural Impact and Strategy These updates highlight a shift toward more efficient memory management and robust concurrency models in the Java ecosystem. Architects should prioritize the Apache Camel security patches while evaluating the performance benefits of JDK 28 features. Staying aligned with these release cycles is essential for maintaining secure, high-performing, and modern backend infrastructure. ## Sources covering this story - https://www.infoq.com/news/2026/10/java-news-roundup-oct12-2026/?utm_campaign=infoq_content&utm_source=infoq&utm_medium=feed&utm_term=global — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._