RELEASE NOTES: JDK 21.0.8

`TypeMirror` Changed to Provide Annotations for Types Loaded from Bytecode

The implementation of TypeMirror now provides access to annotations for types loaded from bytecode. Previously type annotations were not associated with types loaded from bytecode.

Annotation processors can access type annotations for elements using AnnotationMirror#getAnnotationMirrors, and the annotations will be included in the output of AnnotationMirror#toString.

Any programs that relied on annotations being omitted for elements loaded from the classpath should be updated to handle type annotations.

java.net.http.HttpClient Is Enhanced to Report HTTP/2 Flow Control Errors to the Server

The java.net.http.HttpClient will now report HTTP/2 flow control errors to the server when they are detected. This is an implementation detail that should be transparent to users of the HttpClient API, but could result in streams being reset or connections being closed if connecting to a non-conformant HTTP/2 server.

java.net.http.HttpClient Is Enhanced to Report HTTP/2 Flow Control Errors to the Server

The java.net.http.HttpClient will now report HTTP/2 flow control errors to the server when they are detected. This is an implementation detail that should be transparent to users of the HttpClient API, but could result in streams being reset or connections being closed if connecting to a non-conformant HTTP/2 server.

The flow control limits enforced by the client can be specified with two system properties, which can be set on the java command line:

• jdk.httpclient.connectionWindowSize specifies the HTTP/2 client connection window size in bytes. The default value if unspecified is 2^26. Valid values are in the range [2^16-1, 2^31-1]. If an invalid value is provided, the default value is used. The implementation guarantees that the actual value will be no smaller than the stream window size, which can be configured through the jdk.httpclient.windowsize system property.

• jdk.httpclient.windowsize specifies the HTTP/2 client stream window size in bytes. The default value if unspecified is 16777216 or 16 MB. Valid values are in the range [2^14, 2^31-1]. If an invalid value is provided, the default value is used.

New System.map and System.dump_map Diagnostic Commands Have Been Added

New System.map and System.dump_map diagnostic commands have been added to jcmd. When executed, these commands print the virtual memory map of the JVM process, together with Native Memory Tracking information about the virtual memory segments. For the latter information to be displayed, Native Memory Tracking must be enabled.

jcmd <pid> System.map will print the virtual memory map of the JVM indicated by <pid> to the stdout of jcmd.

jcmd <pid> System.dump_map will cause the target JVM indicated by <pid> to print the virtual memory map to a file named vm_memory_map_<pid>.txt into the current directory of the target JVM.

Added 4 New Root Certificates from Sectigo Limited

The following root certificates have been added to the cacerts truststore: ``` + Sectigo Limited + sectigocodesignroote46 DN: CN=Sectigo Public Code Signing Root E46, O=Sectigo Limited, C=GB

• Sectigo Limited

• sectigocodesignrootr46 DN: CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB

• Sectigo Limited

• sectigotlsroote46 DN: CN=Sectigo Public Server Authentication Root E46, O=Sectigo Limited, C=GB

• Sectigo Limited

• sectigotlsrootr46 DN: CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB ```

Removed Two Camerfirma Root Certificates

The following root certificates, which are terminated and no longer in use, have been removed from the cacerts keystore: ``` + alias name "camerfirmachamberscommerceca [jdk]" Distinguished Name: CN=Chambers of Commerce Root, OU=http://www.chambersign.org, O=AC Camerfirma SA CIF A82743287, C=EU

• alias name "camerfirmachambersignca [jdk]" Distinguished Name: CN=Global Chambersign Root - 2008, O=AC Camerfirma S.A., SERIALNUMBER=A82743287, L=Madrid (see current address at www.camerfirma.com/address), C=EU

```

Updated HSS/LMS Public Key Encoding

The X.509 encoded format for HSS/LMS public keys has been updated to align with the latest standard outlined in RFC 9708. Notably, the additional OCTET STRING wrapping around the public key value has been removed. For compatibility, public key encodings generated by earlier JDK releases are still recognized.

Removed Baltimore CyberTrust Root Certificate After Expiry Date

The following expired root certificate has been removed from the cacerts keystore: ` + alias name "baltimorecybertrustca [jdk]" Distinguished Name: CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE `

Compatible OCSP readtimeout Property with OCSP Timeout

In JDK 21, an enhanced syntax for various timeout properties was released through JDK-8179502. This included a new system property, com.sun.security.ocsp.readtimeout, which allows users to control the timeout while reading OCSP responses after a successful TCP connection has been established.

This changes the default posture of this property to be the value of the com.sun.security.ocsp.timeout system property from its original default of 15 seconds. If the com.sun.security.ocsp.timeout system property is also not set, then its default 15 second timeout is propagated to the default for com.sun.security.ocsp.readtimeout.

Incorrect result of Integer.numberOfLeadingZeros

Integer.numberOfLeadingZeros may return an incorrect result on x86_64 with AVX2. The issue is caused by an incorrect JIT compiler optimization. As a workaround, the following command-line options can be used -XX:+UnlockDiagnosticVMOptions -XX:DisableIntrinsic=_numberOfLeadingZeros_i.