RELEASE NOTES: JDK 10

javax.security.auth.Policy API Deprecated forRemoval

The deprecated javax.security.auth.Policy class has been marked forRemoval=true and will be removed in a future release. The javax.security.auth.Policy class has been deprecated since JDK 1.4 and superseded or replaced by java.security.Policy.

Removal of Deprecated Classes in com.sun.security.auth.**

The following deprecated classes that were marked for removal in JDK 9 have been removed:

• com.sun.security.auth.PolicyFile
• com.sun.security.auth.SolarisNumericGroupPrincipal
• com.sun.security.auth.SolarisNumericUserPrincipal
• com.sun.security.auth.SolarisPrincipal
• com.sun.security.auth.X500Principal
• com.sun.security.auth.module.SolarisLoginModule
• com.sun.security.auth.module.SolarisSystem

Removal of Java Launcher's Data Model Options -d32 and -d64

The java launcher's data model selection options (-d32, -d64, -J-d32 and -J-d64) have been removed. They are obsolete and were previously deprecated. To prevent the launcher from failing, users must remove usages of these options when invoking the java launcher or tools such as javac and javah.

XMLInputFactory.newFactory incorrectly deprecated

The @Deprecated annotation was incorrectly added to the newFactory() method in javax.xml.stream.XMLInputFactory. The method should not be deprecated. The newInstance() method can be used to avoid the deprecation warning. A future release will correct this.

XMLInputFactory.newFactory Incorrectly Deprecated

The '@Deprecated' annotation has been removed from the 'newFactory()' method in 'javax.xml.stream.XMLInputFactory'. In Java SE 9, an '@Deprecated' annotation was incorrectly added to the 'newFactory()' method in 'javax.xml.stream.XMLInputFactory'. The method should not have been deprecated. Applications using the 'newInstance()' method are not affected.

java.security.{Certificate,Identity,IdentityScope,Signer} APIs Deprecated forRemoval

The deprecated java.security.{Certificate, Identity, IdentityScope, Signer} classes have been marked forRemoval=true and are subject to removal in a future version of Java SE.

Removal of Deprecated Pre-1.2 SecurityManager Methods and Fields

The following pre-1.2 deprecated java.lang.SecurityManager methods and fields that were marked forRemoval=true have been removed:

• inCheck field
• getInCheck method
• classDepth method
• classLoaderDepth method
• currentClassLoader method
• currentLoadedClass method
• inClass method
• inClassLoader method

In addition, the deprecated checkMemberAccess method has been changed to throw a SecurityException if the caller has not been granted AllPermission. This method is error-prone and users should instead invoke the checkPermission method directly.

Removal of policytool

The policytool security tool has been removed from the JDK.

java.security.acl APIs Deprecated forRemoval

The deprecated java.security.acl APIs have been marked forRemoval=true and are subject to removal in a future version of Java SE.

JEP 319 Root Certificates

Provides a default set of root Certification Authority (CA) certificates in the JDK.

The cacerts keystore of the OpenJDK 9 binary for Linux x64 has been populated by JEP 319: Root Certificates [1] with a set of root certificates issued by the CAs of Oracle's Java SE Root CA Program. This addresses the problem of the empty cacerts keystore in the OpenJDK 9 binary for Linux x64. The empty cacerts keystore had prevented TLS connections from being established because Trusted Root Certificate Authorities were not installed. As a workaround for OpenJDK 9 binaries, users had to set the javax.net.ssl.trustStore System Property to use a different keystore.

[1] https://bugs.java.com/viewbug.do?bugid=JDK-8191486

TLS does not work by default on OpenJDK 9

The OpenJDK 9 binary for Linux x64 contains an empty `cacerts` keystore. This prevents TLS connections from being established because there are no Trusted Root Certificate Authorities installed. You may see an exception like the following: 

javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty

As a workaround, users can set the javax.net.ssl.trustStore System Property to use a different keystore. For example, the ca-certificates package on Oracle Linux 7 contains the set of Root CA certificates chosen by the Mozilla Foundation for use with the Internet PKI. This package installs a trust store at /etc/pki/java/cacerts, which can be used by OpenJDK 9.

Only the OpenJDK 64 bit Linux download is impacted. This issue does not apply to any Oracle JRE/JDK download.

Progress on open-sourcing the Oracle JDK Root CAs can be tracked through the issue JDK-8189131.

jarsigner treats timestamped signed jar invalid after the signer cert expires

If a jar file was signed with a timestamp when the signer certificate was still valid, it should be valid even after the signer certificate expires. However, jarsigner will incorrectly show a warning that that signer's certificate chain is not validated. This will be fixed in a future release.

Accept including .conf files in krb5.conf's includedir

If krb5.conf contains the "includedir DIRNAME" directive and a file in this directory has a name ending with ".conf", its content will be included in krb5.conf. Before this change, only those files whose names consisted solely of alphanumeric characters, dashes, or underscores were included.

Relax FileInputStream/FileOutputStream Requirement for finalize to Call close

The specifications of FileInputStream and FileOutputStream are changed to require calling the close method when "there are no more references to the stream" only in the case where it would affect a subclass that has overridden the close method. The stream's finalize method does not call close directly in this case. In other cases, the release of resources is implementation specific. Refer to the FileInputStream and FileOutputStream documentation for recommendations.

JDK 9 rejects zip files where the modified day or month is 0

The ZipFile implementation has changed significantly in JDK 9 to improve reliability. A consequence of these changes is that the implementation now rejects ZIP files where the month or day in a MS-DOS date/time field is 0. While technically invalid, these ZIP files were not rejected in previous release. A future release will address this issue.

JarFile throws ArrayIndexOutOfBoundsException if the manifest contains Backtick character

An ArrayIndexOutOfBoundsException will be thrown in java.util.jar.JarFile if the Java run-time encounters the backtick (`) character in a JAR file's manifest. This can be worked around by removing backtick characters from the JAR file's manifest.

RMI Registry Filter Allows Binding Arrays of Any Type

The RMI Registry built-in serial filter has been modified to check only the array size and not the component type. The maximum array size has been increased to 1,000,000. The override filter can be used to decrease the limit. Array sizes greater than the maxarray limit will be rejected. Sizes less than the maxarray limit will be allowed.

The java.security file contains more information about the sun.rmi.registry.registryFilter property and the conf/security/java.security configuration file has been updated to better describe the default behavior and how to override it.

Removal of RMI Server-Side Multiplex Protocol Support

The RMI Multiplex protocol was disabled in JDK 9 and has been removed. For the background and history see JDK-8087189.

Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for TLS

The JDK SunJSSE implementation now supports the TLS FFDHE mechanisms defined in RFC 7919. If a server cannot process the supported_groups TLS extension or the named groups in the extension, applications can either customize the supported group names with jdk.tls.namedGroups, or turn off the FFDHE mechanisms by setting the System Property jsse.enableFFDHE to false.

Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for TLS

The JDK SunJSSE implementation now supports the TLS FFDHE mechanisms defined in RFC 7919. If a server cannot process the supported_groups TLS extension or the named groups in the extension, applications can either customize the supported group names with jdk.tls.namedGroups, or turn off the FFDHE mechanisms by setting the System Property jsse.enableFFDHE to false.

TLS Session Hash and Extended Master Secret Extension Support

Support has been added for the TLS session hash and extended master secret extension (RFC 7627) in JDK JSSE provider. Note that in general, a server certificate change is restricted if endpoint identification is not enabled and the previous handshake is a session-resumption abbreviated initial handshake, unless the identities represented by both certificates can be regarded as the same. However, if the extension is enabled or negotiated, the server certificate changing restriction is not necessary and will be discarded accordingly. In case of compatibility issues, an application may disable negotiation of this extension by setting the System Property jdk.tls.useExtendedMasterSecret to false in the JDK. By setting the System Property jdk.tls.allowLegacyResumption to false, an application can reject abbreviated handshaking when the session hash and extended master secret extension are not negotiated. By setting the System Property jdk.tls.allowLegacyMasterSecret to false, an application can reject connections that do not support the session hash and extended master secret extension.

Removal of HostServices::getWebContext Method

The HostServices::getWebContext method, which was deprecated for removal in JDK 9, has been removed. There is no replacement for this functionality. Applications will no longer be able to communicate with the enclosing web page of a JavaFX Applet. Note that the Java Plug-in, on which this functionality depends, is deprecated for removal as well.

Overriding Methods That Do Not Change the Specification

A new option --overridden-methods=value, has been added to the javadoc tool. Many classes override inherited methods without changing the specification. The --overridden-methods=value option can be used to group these methods with other inherited methods, instead of documenting them in detail with the other methods declared in the class. For more details, see the javadoc section in the Tools Reference document.

javadoc Treats Failure to Access a URL as an Error

The javadoc tool has been changed to treat failure to access a URL as an error instead of a warning. If javadoc cannot access the contents of a URL provided with the -link or -linkoffline options, the tool will now report an error. Previously, the tool continued with a warning and produced incorrect documentation output.

Removal of Old (JDK 6, JDK 7, and JDK 8 Era) Standard Doclet

The old (JDK 6, JDK 7 and JDK 8 era) standard doclet, which outputs HTML content, and which has been superseded by a replacement, has been removed in this release. The underlying javadoc API (see com.sun.javadoc in the API documentation) has been deprecated, but is still available for the time being, for use by user-provided doclets.

HTML Files in doc-files Subdirectories Wrapped with Standard javadoc Decorations

The standard doclet has been updated to copy HTML files in the doc-files subdirectories for the packages being documented to the document output directory. The content of these files are wrapped with the standard header, footer, and navigation bars. In addition, any appropriate comment tags within these files are processed. Note: Some files may not be wrapped. This is a known bug.

Comment Tag for Summary of an API Description

A new inline tag, {@summary ...}, has been added to explicitly specify the text used as the summary of the API description. By default, the summary of an API description is inferred from the first sentence. This is determined by using either a simple algorithm or java.text.BreakIterator. However, the heuristics for this are not always correct and can lead to an incorrect determination of the end of the first sentence. The new tag enables the API summary text to be explicitly set instead of inferred. Please refer to Documentation Comment Specification for the Standard Doclet.

javadoc Support for Multiple Stylesheets

A new javadoc command-line option, --add-stylesheet, has been added to the javadoc tool. The new --add-stylesheet option provides support for the use of multiple stylesheets in the generated documentation. The existing -stylesheetfile option now has an alias, --main-stylesheet, to help distinguish the main stylesheet from any additional stylesheets. For more details, see the javadoc section in the Tools Reference document.

JEP 307: Parallel Full GC for G1

Improves G1 worst-case latencies by making the full GC parallel. The G1 garbage collector is designed to avoid full collections, but when the concurrent collections can't reclaim memory fast enough a fall back full GC will occur. The old implementation of the full GC for G1 used a single threaded mark-sweep-compact algorithm. With JEP 307 the full GC has been parallelized and now use the same amount of parallel worker threads as the young and mixed collections.

print_tracing_info Uses Unified Logging

The two flags, TraceYoungGenTime and TraceOldGenTime, have been removed. The same information is now available by using Unified Logging and enabling the tag-set gc+heap+exit at the debug level.

Error Message When java.lang.IllegalAccessError Produced

An enhancement has been made to improve the error message produced by javac when a java.lang.IllegalAccessError is thrown because external tools have loaded javac classes with multiple class loaders.

Bytecode Generation for Enhanced for Loop

Bytecode generation has been improved for enhanced for loops, providing an improvement in the translation approach for them. For example: ` List<String> data = new ArrayList<>(); for (String b : data); The following is the code generated after the enhancement: `` { /synthetic/ Iterator i$ = data.iterator(); for (; i$.hasNext(); ) { String b = (String)i$.next(); } b = null; i$ = null; } ``` Declaring the iterator variable outside of the for loop allows a null to be assigned to it as soon as it is no longer used. This makes it accessible to the GC, which can then get rid of the unused memory. Something similar is done for the case when the expression in the enhanced for loop is an array.

New Class AST Node With enclosing Instance

New Class AST nodes with an enclosing instance that incorrectly return a null have been fixed. In some cases, the getEnclosingExpression() method of the NewClassTree AST node was returning null for code like:

` <enclosing>.new <Class>(...) { ... } `

This has been fixed, and getEnclosingExpression() now returns the enclosing expression.

Optional.orElseThrow() Method

A new method orElseThrow has been added to the Optional class. It is synonymous with and is now the preferred alternative to the existing get method.

JNLP files won't launch from IE11 on Windows 10 Creators Update

Web-start applications cannot be launched when clicking JNLP link from IE 11 on Windows 10 Creators Update when 64-bit JRE is installed. Workaround is to uninstall 64-bit JRE and use only 32-bit JRE.

JNLP files won't launch from IE11 on Windows 10 Creators Update

Web-start applications cannot be launched when clicking JNLP link from IE 11 on Windows 10 Creators Update when 64-bit JRE is installed. Workaround is to uninstall 64-bit JRE and use only 32-bit JRE.

URLStreamHandlerFactory unavailable to Web Start applications

In JDK 9, Java Web Start applications are prohibited from using URLStreamHandlerFactory. Using URLStreamHandlerFactory via javaws will result in an exception with the message "factory already defined."

Applications launched directly with java command are not impacted.

JShell Startup

The time needed to start JShell has been significantly reduced, especially in cases where a start file with many snippets is used.

Removal of Deprecated VP6/FXM/FLV Code From JavaFX

Support for VP6 video encoding format and FXM/FLV container has been removed in JavaFX Media. Users are encouraged to use H.264/AVC1 in the MP4 container or HTTP Live Streaming instead.

JEP 313 Remove the Native-Header Generation Tool (javah)

As previously announced, the native-header tool, javah, has been removed.

Native headers can now be generated by using the Java compiler, javac, with the -h option.

Removal of Runtime.getLocalizedInputStream and getLocalizedOutputStream Methods

The methods Runtime.getLocalizedInputStream and Runtime.getLocalizedOutputStream have been removed. They were part of an obsolete internationalization mechanism and have no known uses.

MBeanOperationInfo Accepts Any int Value as "impact"

A new validation for the impact parameter of javax.management.MBeanOperationInfo.MBeanOperationInfo constructor has been introduced. MBeanOperationInfo now throws a new IllegalArgumentException if the impact provided is not one of INFO, ACTION, ACTION_INFO, or UNKNOWN.

Removal of FlatProfiler

The FlatProfiler, deprecated in JDK 9, has been made obsolete by removing the implementation code. The FlatProfiler was enabled by setting the -Xprof VM argument. The -Xprof flag remains recognized in this release; however, setting it will print out a warning message.

Change to Default Value for BiasedLockingStartupDelay

The default value for BiasedLockingStartupDelay has been changed to 0. The flag BiasedLockingStartupDelay previously had the default value 4000 which delayed the use of biased locking with 4 s (4000 ms). The reason for this delay was performance but recent performance runs show no difference between the 4000 ms delay and no delay. Since having the delay will cause other parts of the VM to do extra work, having the default set to 0 makes more sense.

Removal of Obsolete -X Options

The obsolete HotSpot VM options (-Xoss, -Xsqnopause, -Xoptimize, -Xboundthreads, and -Xusealtsigs) have been removed.

Java Improvements for Docker Containers

The following changes have been introduced in JDK 10 to improve the execution and configurability of Java running in Docker containers:

• JDK-8146115 Improve docker container detection and resource configuration usage

The JVM has been modified to be aware that it is running in a Docker container and will extract container specific configuration information instead of querying the operating system. The information being extracted is the number of CPUs and total memory that have been allocated to the container. The total number of CPUs available to the Java process is calculated from any specified cpu sets, cpu shares or cpu quotas. This support is only available on Linux based platforms. This new support is enabled by default and can be disabled in the command line with the JVM option:

-XX:-UseContainerSupport

In addition, this change adds a JVM option that provides the ability to specify the number of CPUs that the JVM will use:

-XX:ActiveProcessorCount=count

This count overrides any other automatic CPU detection logic in the JVM.

• JDK-8186248 Allow more flexibility in selecting Heap % of available RAM

Three new JVM options have been added to allow Docker container users to gain more fine grained control over the amount of system memory that will be used for the Java Heap:

• -XX:InitialRAMPercentage
• -XX:MaxRAMPercentage
• -XX:MinRAMPercentage

These options replace the deprecated Fraction forms (-XX:InitialRAMFraction, -XX:MaxRAMFraction, and -XX:MinRAMFraction).

• JDK-8179498 attach in linux should be relative to /proc/pid/root and namespace aware

This bug fix corrects the attach mechanism when trying to attach from a host process to a Java process that is running in a Docker container.

APIs for Creating Unmodifiable Collections

Several new APIs have been added that facilitate the creation of unmodifiable collections. The List.copyOf, Set.copyOf, and Map.copyOf methods create new collection instances from existing instances. New methods toUnmodifiableList, toUnmodifiableSet, and toUnmodifiableMap have been added to the Collectors class in the Stream package. These allow the elements of a Stream to be collected into an unmodifiable collection.

java.xml APIs With Raw Types and Type Parameters

A number of java.xml APIs containing method declarations with raw types have been updated to add a type parameter. The updated methods are:

• javax.xml.namespace.NamespaceContext

Iterator<String> getPrefixes(String namespaceURI);

• javax.xml.xpath.XPathFunction

public Object evaluate(List<?> args)

• org.xml.sax.helpers.NamespaceSupport

public Enumeration<String> getPrefixes () public Enumeration<String> getPrefixes (String uri) public Enumeration<String> getDeclaredPrefixes ()

java.awt.TrayIcon.displayMessage() Reimplemented on macOS

On macOS, the java.awt.TrayIcon.displayMessage() method has been re-implemented to use the NSUserNotification api to show messages to users. New messages on macOS are now shown by using the standard notification center instead of a custom window.

Touch Keyboard for Swing/AWT Text Components

This release adds support for automatically showing the touch keyboard for Swing/AWT text components on Microsoft Windows 8 or later. A user can display the touch keyboard either by using a touch screen to tap the text component area or by using a mouse to click in the area, when a keyboard is not attached to a computer.

The system property awt.touchKeyboardAutoShowIsEnabled controls whether this functionality is enabled in the JDK. This functionality is enabled by default. However, if the functionality is not needed, the user can switch it off from the command line by setting the system property to false:

-Dawt.touchKeyboardAutoShowIsEnabled=false

Removal of Support for Using Old LookAndFeel

It is no longer possible for applications to use old or unsupported LookAndFeels. Some applications (such as, Nimbus and Aqua) used old class names to instantiate JDK internal Swing LookAndFeels. For example:

• javax.swing.UIManager.setLookAndFeel("com.sun.java.swing.plaf.nimbus.NimbusLookAndFeel");
• javax.swing.UIManager.setLookAndFeel("apple.laf.AquaLookAndFeel");

These classes were internal to the JDK and applications should have always treated them as such. Applications that use these class names to instantiate JDK internal Swing LookAndFeels must migrate now to the following APIs:

• For Nimbus use:

UIManager.setLookAndFeel("javax.swing.plaf.nimbus.NimbusLookAndFeel");

• For Aqua use:

UIManager.setLookAndFeel(UIManager.getSystemLookAndFeelClassName());

Hashed Passwords for Out-of-the-Box JMX Agent

The clear passwords present in the jmxremote.password file are now being over-written with their SHA3-512 hash by the JMX agent. Each line for the role follows the format:

role_name W hashedPassword

Where:

• role_name is any string that does not itself contain spaces or tabs.
• W = spaces or tabs

The hashed password follows the format:

hashedPassword = base64encoded64bytesalt W base64encodedhash W hash_algorithm

Where:

• base64encoded64bytesalt = 64 byte random salt
• base64encodedhash = Hash_algorithm(password + salt)
• W = spaces or tabs
• hash_algorithm = Algorithm string specified using a format in https://docs.oracle.com/javase/10/docs/specs/security/standard-names.html#messagedigest-algorithms This is an optional field. If not specified, SHA3-512 is assumed to be the algorithm string.

If passwords are in the clear, they are overwritten by their hash if all of the following criteria are met:

1. com.sun.management.jmxremote.password.toHashes property is set to true in the management.properties file.
2. The password file is writable.
3. The system security policy allows writing into the password file if a security manager is configured.

In order to change the password for a role, replace the hashed password entry with a new clear-text password or a new hashed password. If the new password is in the clear, it will be replaced with its hash when a new login attempt is made.

A given role should have at least one entry in this file. If a role has no entry, it has no access. If multiple entries are found for the same role name, then the last one is used.

A user generated hashed password file can also be used instead of a clear-text password file. If generated by the user, hashed passwords must follow the format specified above.

This file must be made accessible by ONLY the owner, otherwise the program will exit with an error.

In order to prevent inadvertent edits to the password file in a production environment, it is recommended that a read-only hashed password file be deployed. The hashed entries for clear passwords can be generated in advance by running the JMX agent.

It is recommended that the password file not be edited while the agent is running. Edits could be lost if a client connection triggers the hashing of the password file at the same time that the file is externally modified. The integrity of the file is guaranteed, but any external edits made to the file during the short period between the time that the agent reads the file and the time that it writes it back might be lost.