RELEASE NOTES: JDK 21.0.4

Fallback Option For POST-only OCSP Requests

JDK 17 introduced the performance improvement that made OCSP client unconditionally use GET requests for small requests, while doing POST requests for everything else. This is explicitly allowed and recommended by RFC 5019 and RFC 6960. However, we have seen OCSP responders that, despite RFC requirements, are not working well with GET requests.

This release introduces a new JDK system property to allow fallback to POST-only behavior to unblock interaction with those OCSP responders: -Dcom.sun.security.ocsp.useget={false,true}. This amends the original change that introduced GET OCSP requests (JDK-8179503). The default behavior is not changed; the option defaults to true. Set the option to false to disable GET OCSP requests. Any value other than false (case-insensitive) defaults to true.

This option is non-standard, and might go away once problematic OCSP responders get upgraded.

Native Executables and Libraries on Linux Use `RPATH` Instead of `RUNPATH`

Native executables and libraries on Linux have switched to using RPATH instead of RUNPATH in this release.

JDK native executables and libraries use embedded runtime search paths to locate other internal JDK native libraries. On Linux these can be defined as either RPATH or RUNPATH. The main difference is that the dynamic linker considers RPATH before the LD_LIBRARY_PATH environment variable, while RUNPATH is only considered after LD_LIBRARY_PATH.

By making the change to using RPATH, it is no longer possible to inject external replacements for JDK internal native libraries using LD_LIBRARY_PATH.

New Security Category for `-XshowSettings` Launcher Option

The -XshowSettings launcher has a new security category. Settings from security properties, security providers and TLS related settings are displayed with this option. A security sub-category can be passed as an argument to the security category option. See the output from java -X:

` -XshowSettings:security show all security settings and continue -XshowSettings:security:*sub-category* show settings for the specified security sub-category and continue. Possible *sub-category* arguments for this option include: all: show all security settings and continue properties: show security properties and continue providers: show static security provider settings and continue tls: show TLS related security settings and continue `

Third party security provider details will be reported if they are included in the application class path or module path and such providers are configured in the java.security file.

G1: Balance Code Root Scan Phase during Garbage Collection

The Code Root Scan Phase during garbage collection finds references to Java objects in compiled code. To speed up this process, G1 maintains a remembered set for compiled code that contains references into the Java heap. That is, every region contains a set of compiled code that contains references into it.

Assuming that such references are few, previous code used a single thread per region to iterate over a particular region's references, which poses a scalability bottleneck if the distribution of these references is very unbalanced.

G1 now distributes this code root scan work across multiple threads within regions, removing this bottleneck.