RELEASE NOTES: JDK 27.0.2

Capture Named Group information in TLSHandshakeEvent

The jdk.TLSHandshakeEvent JFR event now records the named group that is negotiated in a TLS handshake. A new field named namedGroup has been added to the event.

Allow configuration of the JVM's temporary directory on Linux

An advanced serviceability option has been added to the JVM to allow configuration of an alternate temporary directory on Linux.

-XX:AltTempDir=/path

On Linux, the usual directory to use for temporary files is /tmp. In some secure container environments however, /tmp is made read-only and so is unusable by the VM for its temporary files. To accommodate this uncommon circumstance the -XX:AltTempDir flag can be used to tell the VM to use a different temporary directory.

See the java man page under ADVANCED SERVICEABILITY OPTIONS FOR JAVA for more details.

Launching of application in Desktop.browse() is disabled by default

A new implementation System Property (awt.desktop.browse_insecure) is provided to partially re-enable previous behaviour of the java.awt.Desktop.browse() API. This is an opt-in property, and the value is a comma-separated list of URL schemes.

Eg :

-Dawt.desktop.browse_insecure=file,ftps,myapp

Background : On Windows and macOS platforms, the historic behaviour of the java.awt.Desktop.browse() API was to invoke platform APIs, rather than directly invoking the default browser.

Since this behavior is now disabled, applications registered with the platform desktop may no longer be launched unless the browser also supports launching the application.

Usage : As a specific example on Windows, the new behaviour is that invoking a file:/// URL will display in the browser.

To re-enable the previous behaviour of launching the Windows Explorer application, on the command line specify

-Dawt.desktop.browse_insecure=file

To re-enable all schemes the application should specify a wild card value, which should be used with extreme caution

-Dawt.desktop.browse_insecure=*

Entrust G4 Root CA Removed

The following root certificate has been removed from the cacerts keystore: ``` + alias name "entrustrootcag4 [jdk]" Distinguished Name: CN=Entrust Root Certification Authority - G4, OU="(c) 2015 Entrust, Inc. - for authorized use only", OU=See www.entrust.net/legal-terms, O="Entrust, Inc.", C=US

```

Added Certum Trusted Root CA and Certum EC-384 CA Certificates

The following root certificates have been added to the cacerts truststore: ``` + Certum + certumtrustedrootca DN: CN=Certum Trusted Root CA, OU=Certum Certification Authority, O=Asseco Data Systems S.A., C=PL

• Certum
• certumec384ca DN: Certum EC-384 CA, OU=Certum Certification Authority, O=Asseco Data Systems S.A., C=PL ```

jlink --strip-debug` now removes external debug symbol files (.debuginfo, .diz, .dSYM, .pdb)

jlink --strip-debug now removes external debug symbol files (.debuginfo, .diz, .dSYM, .pdb)

The jlink --strip-debug option previously only stripped embedded native debug symbols from executables and shared libraries (i.e. debug info stored inside the binary itself). When a JDK was built with --with-native-debug-symbols=external — the default for fastdebug and debug builds — the accompanying .debuginfo and .diz files were silently copied into the resulting image, leaving debug information present despite the intent of --strip-debug.

The option now consistently excludes external debug symbol files (.debuginfo and .diz) from the generated image on Linux, regardless of how the source JDK was built. The behavior for builds using --with-native-debug-symbols=internal is unchanged.