RELEASE NOTES FOR: 21.0.14
====================================================================================================

Notes generated: Mon Oct 12 06:14:37 CEST 2026

Hint: Prefix bug IDs with https://bugs.openjdk.org/browse/ to reach the relevant JIRA entry.

JAVA ENHANCEMENT PROPOSALS (JEP):

  None.

RELEASE NOTES:

hotspot/runtime:

    JDK-8359706: VM.info and hs_err_pid Logs Now Report Current Open File Descriptors 

      The output of the [jcmd] `VM.info` diagnostic command and HotSpot fatal error logs
      (`hs_err_pid`) now include the current number of open file descriptors for the running Java
      process. On supported platforms, the new output displays the active file descriptor count in
      the `SYSTEM` section (for example, `Open File Descriptors: 52`). This enhancement helps
      diagnose and troubleshoot resource exhaustion and `Too many open files` issues on UNIX
      platforms. 
      
      Note that the maximum file descriptor limit for the process is already reported in the same
      output as the `NOFILE` value (for example, `NOFILE 10240/infinity`). 

security-libs/java.security:

    JDK-8386371: Entrust G4 Root CA Removed

      The following root certificate has been removed from the `cacerts` keystore: ``` + alias name
      "entrustrootcag4 [jdk]"   Distinguished Name: CN=Entrust Root Certification Authority - G4,
      OU="(c) 2015 Entrust, Inc. - for authorized use only", OU=See www.entrust.net/legal-terms,
      O="Entrust, Inc.", C=US
      
      ```


ALL FIXED ISSUES, BY COMPONENT AND PRIORITY:

client-libs/2d:
  (P3) JDK-8386576: Calculating Area using a complex polygon creates spurious horizontal line segments

core-libs/java.net:
  (P4) JDK-8387273: Enhance httpserver logging to log when maxConnections is reached
  (P4) JDK-8375352: java/net/httpclient/ConnectTimeoutWithProxy*.java tests fail on EC2
  (P4) JDK-8373676: Test javax/net/ssl/HttpsURLConnection/SubjectAltNameIP.java fails on a machine without IPV6
  (P4) JDK-8386595: Two java/net/MulticastSocket tests fail on machines with no ipv6 address other than loopback

core-libs/java.nio:
  (P3) JDK-8390212: (dc) On AIX, DatagramChannel.join can join IPv4 multicast group with IPv6 socket
  (P4) JDK-8392608: UnixNativeDispatcher.strerror should use given error code

core-libs/java.time:
  (P3) JDK-8393337: (tz) Update Timezone Data to 2026e
  (P4) JDK-8392377: (tz) Update Timezone Data to 2026d

core-libs/java.util:i18n:
  (P3) JDK-8392538: Align the JDK with Microsoft's new timezone names for British Columbia/Alberta
  (P3) JDK-8392519: Cherry-pick metazone changes from CLDR for tzdata2026d, for JDK update release
  (P4) JDK-8393344: Cherry-pick metazone changes from CLDR to support tzdata2026e for JDK update releases
  (P4) JDK-8343788: Provide means to alter lib/tzmappings entries on Windows
  (P4) JDK-8317126: Redundant entries in Windows `tzmappings` file

core-svc/tools:
  (P4) JDK-8380896: Reduce runtime for MonitorVmStartTerminate.java on hosts with a lot of VMs

hotspot/compiler:
  (P3) JDK-8390765: [PPC64] AES Crypto intrinsics may access memory beyond the key array
  (P3) JDK-8376400: C2: folding ifs may cause incorrect execution when trap is taken
  (P3) JDK-8339526: C2: store incorrectly removed for clone() transformed to series of loads/stores
  (P3) JDK-8391881: RISC-V: jni_fast_Get<Primitive>Field registers the wrong pc for the speculative load
  (P4) JDK-8391757: [PPC64] C1 runs into assertion with -XX:+VerifyOops
  (P4) JDK-8386474: Aarch64: Correct static_assert((N & (N - 1)) == 0
  (P4) JDK-8390521: RISC-V: Clean up vector register dispatch in MachSpillCopyNode::implementation
  (P4) JDK-8390441: RISC-V: Fix C2 stack-to-stack spill copies with large offsets
  (P4) JDK-8391041: RISC-V: Fix out-of-bounds read in string_indexof_char intrinsic

hotspot/gc:
  (P3) JDK-8331695: Serial: DefNewGeneration:_promotion_failed used without being initialized
  (P3) JDK-8339651: ShenandoahPacer::setup_for_mark, ShenandoahPacer::setup_for_updaterefs and ShenandoahPacer::setup_for_evac runtime error: division by zero
  (P4) JDK-8388284: [s390] resolve_jobject uses wrong branch condition after tmll

hotspot/jfr:
  (P3) JDK-8383367: jdk/jfr/event/oldobject/TestDFSWithSmallStack.java failed with -XX:+UseZGC -XX:+UseCompactObjectHeaders

hotspot/jvmti:
  (P4) JDK-8375367: vmTestbase tests reported variable uninitialized by clang23

hotspot/runtime:
  (P2) JDK-8380236: macOS build is broken by JDK-8359706
  (P4) JDK-8359706: Add file descriptor count to VM.info
  (P4) JDK-8339331: GCC fortify error in vm_version_linux_aarch64.cpp
  (P4) JDK-8300800: UB: Shift exponent 32 is too large for 32-bit type 'int'

hotspot/svc:
  (P4) JDK-8379516: Adjust JVM debug helper exports

hotspot/svc-agent:
  (P4) JDK-8378838: Fix issues with "dead" code elimination and serviceability agent in libjvm.so on Linux

infrastructure:
  (P4) JDK-8391437: Bump update version for OpenJDK: jdk-21.0.14

infrastructure/build:
  (P4) JDK-8350801: Add a code signing hook to the JDK build system
  (P4) JDK-8310369: UTIL_ARG_WITH fails when arg is disabled

security-libs/java.security:
  (P4) JDK-8386371: Remove Entrust G4 root CA

security-libs/javax.crypto:pkcs11:
  (P4) JDK-8388872: Avoid unused variables warnings in libj2pkcs11

security-libs/javax.net.ssl:
  (P3) JDK-8393697: [21u] Fix issue in backport of 8368514
  (P4) JDK-8392076: Sporadic failure of test InvalidateServerSessionRenegotiate.java
  (P4) JDK-8392780: Sporadic failure of test ServerRenegoWithTwoVersions.java and NoImpactServerRenego.java
  (P4) JDK-8382222: sun/security/ssl/SSLSocketImpl/SSLSocketBruteForceClose.java fails sporadically
  (P4) JDK-8368514: TLS stateless session ticket decryption fails on some providers

tools/javac:
  (P4) JDK-8331030: langtools/tools/javac/tree tests fail with SOE with fastdebug and -Xcomp