RELEASE NOTES: JDK 22.0.2

`jpackage` Apps May Fail to Build on Debian Linux Distros Due to Missing Shared Libraries

There is an issue on Debian Linux distros where jpackage could not always build an accurate list of required packages from shared libraries with symbolic links in their paths, causing installations to fail due to missing shared libraries.

`jpackage` May Produce an Inaccurate List of Required Packages on Debian Linux Distros

Fixed an issue on Debian Linux distros where jpackage could not always build an accurate list of required packages from shared libraries with symbolic links in their paths, causing installations to fail due to missing shared libraries.

Fallback Option For POST-only OCSP Requests

JDK 17 introduced a performance improvement that made OCSP clients unconditionally use GET requests for small requests, while doing POST requests for everything else. This is explicitly allowed and recommended by RFC 5019 and RFC 6960. However, we have seen OCSP responders that, despite RFC requirements, are not working well with GET requests.

This release introduces a new JDK system property to allow clients to fallback to POST-only behavior. This unblocks interactions with those OCSP responders through the use of -Dcom.sun.security.ocsp.useget={false,true}. This amends the original change that introduced GET OCSP requests (JDK-8179503). The default behavior is not changed; the option defaults to true. Set the option to false to disable GET OCSP requests. Any value other than false (case-insensitive) defaults to true.

This option is non-standard, and might go away once problematic OCSP responders get upgraded.

Native Executables and Libraries on Linux Use `RPATH` Instead of `RUNPATH`

Native executables and libraries on Linux have switched to using RPATH instead of RUNPATH in this release.

JDK native executables and libraries use embedded runtime search paths to locate other internal JDK native libraries. On Linux these can be defined as either RPATH or RUNPATH. The main difference is that the dynamic linker considers RPATH before the LD_LIBRARY_PATH environment variable, while RUNPATH is only considered after LD_LIBRARY_PATH.

By making the change to using RPATH, it is no longer possible to replace JDK internal native libraries using LD_LIBRARY_PATH.

Added GlobalSign R46 and E46 Root CA Certificates

The following root certificates have been added to the cacerts truststore: ``` + GlobalSign + globalsignr46 DN: CN=GlobalSign Root R46, O=GlobalSign nv-sa, C=BE

• GlobalSign
• globalsigne46 DN: CN=GlobalSign Root E46, O=GlobalSign nv-sa, C=BE ```

Parallel GC Throws OOM Before Heap Is Fully Expanded

An existing bug may have prevented the full usage of the Java heap allotted with the command line flag -Xmx. That bug has been fixed with JDK-8328744. As a side effect of this fix, installations may experience an increased heap usage when using Parallel GC. Customers should, if necessary, adjust the maximum heap size.

Name Change for Filler Array Objects from `jdk.vm.internal.FillerArray` to `[Ljdk/internal/vm/FillerElement;`

One HotSpot virtual machine internal class to indicate an area of dead (unreachable) memory has been renamed to conform to the Java class naming standard to avoid confusing external applications parsing virtual machine class histograms provided by jmap -histo.

There are applications that parse the output of jmap -histo which fail when encountering the class jdk.vm.internal.FillerArray. In particular, the issue is that this type of filler object represents a flexibly sized range of unreachable memory but is named as if it were a fixed size non-array object. Then, for example, calculating the instance size of these objects from the jmap -histo output can result in non-integral instance sizes, confusing applications.

This problem has been fixed by changing the name of this class to the array-like name [Ljdk/internal/vm/FillerElement;.