RELEASE NOTES: JDK 21.0.4

Fallback Option For POST-only OCSP Requests

JDK 17 introduced a performance improvement that made OCSP clients unconditionally use GET requests for small requests, while doing POST requests for everything else. This is explicitly allowed and recommended by RFC 5019 and RFC 6960. However, we have seen OCSP responders that, despite RFC requirements, are not working well with GET requests.

This release introduces a new JDK system property to allow clients to fallback to POST-only behavior. This unblocks interactions with those OCSP responders through the use of -Dcom.sun.security.ocsp.useget={false,true}. This amends the original change that introduced GET OCSP requests (JDK-8179503). The default behavior is not changed; the option defaults to true. Set the option to false to disable GET OCSP requests. Any value other than false (case-insensitive) defaults to true.

This option is non-standard, and might go away once problematic OCSP responders get upgraded.

Native Executables and Libraries on Linux Use `RPATH` Instead of `RUNPATH`

Native executables and libraries on Linux have switched to using RPATH instead of RUNPATH in this release.

JDK native executables and libraries use embedded runtime search paths to locate other internal JDK native libraries. On Linux these can be defined as either RPATH or RUNPATH. The main difference is that the dynamic linker considers RPATH before the LD_LIBRARY_PATH environment variable, while RUNPATH is only considered after LD_LIBRARY_PATH.

By making the change to using RPATH, it is no longer possible to replace JDK internal native libraries using LD_LIBRARY_PATH.

New Security Category for `-XshowSettings` Launcher Option

The -XshowSettings launcher has a new security category. Settings from security properties, security providers, and TLS related settings are displayed with this option. A security sub-category can be passed as an argument to the security category option. See the output from java -X:

` -XshowSettings:security show all security settings and continue -XshowSettings:security:*sub-category* show settings for the specified security sub-category and continue. Possible *sub-category* arguments for this option include: all: show all security settings and continue properties: show security properties and continue providers: show static security provider settings and continue tls: show TLS related security settings and continue `

Third party security provider details will be reported if they are included in the application class path or module path and such providers are configured in the java.security file.

Added GlobalSign R46 and E46 Root CA Certificates

The following root certificates have been added to the cacerts truststore: ``` + GlobalSign + globalsignr46 DN: CN=GlobalSign Root R46, O=GlobalSign nv-sa, C=BE

• GlobalSign
• globalsigne46 DN: CN=GlobalSign Root E46, O=GlobalSign nv-sa, C=BE ```

`jpackage` Apps May Fail to Build on Debian Linux Distros Due to Missing Shared Libraries

There is an issue on Debian Linux distros where jpackage could not always build an accurate list of required packages from shared libraries with symbolic links in their paths, causing installations to fail due to missing shared libraries.

`jpackage` May Produce an Inaccurate List of Required Packages on Debian Linux Distros

Fixed an issue on Debian Linux distros where jpackage could not always build an accurate list of required packages from shared libraries with symbolic links in their paths, causing installations to fail due to missing shared libraries.

Parallel GC Throws OOM Before Heap Is Fully Expanded

An existing bug may have prevented the full usage of the Java heap allotted with the command line flag -Xmx. That bug has been fixed with JDK-8328744. As a side effect of this fix, installations may experience an increased heap usage when using Parallel GC. Customers should, if necessary, adjust the maximum heap size.

G1: More Deterministic Heap Resize at Remark

During the Remark pause G1 adjusts the Java heap size to keep a minimum and maximum amount of free regions as set via the -XX:MinHeapFreeRatio and -XX:MaxHeapFreeRatio options.

Before this change, G1 considered Eden regions as occupied (full) for this calculation. This makes heap sizing very dependent on current Eden occupancy, although after the next garbage collection these regions will be empty. With this change, Eden regions are considered as empty (free) for matters of Java heap sizing. This new policy also aligns Java heap sizing to full GC heap sizing.

The effect is that G1 now expands the Java heap less aggressively and more deterministically, with corresponding memory savings but potentially executing more garbage collections.

G1: Balance Code Root Scan Phase During Garbage Collection

The Code Root Scan Phase during garbage collection finds references to Java objects in compiled code. To speed up this process, G1 maintains a remembered set for compiled code that contains references into the Java heap. That is, every region contains a set of compiled code that contains references into it.

Assuming that such references are few, previous code used a single thread per region to iterate over a particular region's references, which poses a scalability bottleneck if the distribution of these references is very unbalanced.

G1 now distributes this code root scan work across multiple threads within regions, removing this bottleneck.