JDK 27 is out: should you upgrade, and which of the 9 JEPs matter

Every September the question comes back: do we move? I read the OpenJDK page and all nine JEPs on 3 October 2026 so you don't have to. I haven't installed or benchmarked JDK 27, so everything below comes from the JEPs and Oracle's published roadmap. Where a number appears, it is the JEP authors' number.

Is JDK 27 released, and is it an LTS?

JDK 27 is released and it is not an LTS. The OpenJDK page says it "reached General Availability on 15 September 2026." Oracle's roadmap lists Java 8, 11, 17, 21 and 25 as LTS releases and Java 29 as the next planned one, in September 2027.

That makes 27 a six-month release. Oracle's policy calls non-LTS releases "a cumulative set of implementation enhancements of the most recent LTS release," and says a previous non-LTS release is superseded when the next feature release ships. In practice, Java 27 stops getting updates when Java 28 arrives in March 2027.

Which JEPs matter, and which can wait?

Four of the nine JEPs are finished features that change behaviour in production: G1 as the default collector, compact object headers, post-quantum TLS and JFR redaction. The other five are previews or an incubator. You have to opt in to those, so they can wait unless you are the kind of team that tries new APIs early.

What does the G1 default change?

JEP 523 makes G1 the default garbage collector in every environment. Before, the JVM picked Serial on machines with one CPU or under 1792 MB of memory. Now, if you set no collector on the command line, the JVM "will always select G1, regardless of the number of processors and the available physical memory."

This matters most for small containers. A service pinned to one CPU or a small memory limit used to get Serial silently. After upgrading it gets G1. The JEP says G1 has improved "across all metrics" and that Serial-selected cases should not "degrade significantly" in throughput, latency, memory footprint or startup. It also admits that "some applications in constrained environments will still perform best with Serial." If that is you, set the collector explicitly. An explicit choice always overrides the default.

What do compact object headers do?

JEP 534 turns compact object headers on by default. They shrink each object's header from 96 bits to 64 bits on 64-bit JVMs, which cuts heap use. The feature arrived in JDK 24 and became a product feature in JDK 25, so this is the step from "opt in" to "opt out."

The JEP cites its own experiments: 22% less heap and 8% less CPU time on SPECjbb2015 in one setting, 15% fewer garbage collections with G1 and Parallel, and a highly parallel JSON parser benchmark running in 10% less time. Those are the authors' figures. Your result depends on how many small objects your code allocates. To turn it off, run with -XX:-UseCompactObjectHeaders. The old layout is not removed, though the JEP says Oracle intends to deprecate it in a future release.

What is post-quantum TLS in Java 27?

JEP 527 adds hybrid key exchange to TLS 1.3. "Hybrid" means it combines a quantum-resistant algorithm (ML-KEM) with a classic elliptic-curve one, so the connection stays safe if either holds. The goal is to blunt "harvest now, decrypt later," where someone records encrypted traffic today and cracks it once quantum computers can.

It adds three schemes: X25519MLKEM768, SecP256r1MLKEM768 and SecP384r1MLKEM1024. Only X25519MLKEM768 is on by default, placed first in the client's preference list. Your code needs no change if it does not pick key exchange schemes itself. It only covers javax.net.ssl and TLS 1.3. The JEP names jdk.tls.namedGroups and SSLParameters::setNamedGroups as the ways to change the list. The risk to check is old middleboxes or servers that mishandle larger handshakes. I did not test that.

What is in the preview and incubator JEPs?

Five JEPs ask you to opt in, and four are previews. Structured concurrency is on its seventh preview round. Primitive types in patterns is on its fifth, "without change." Lazy constants is on its third, with Set.ofLazy(...) added and isInitialized and orElse removed. PEM encodings is on its third, with renames. The Vector API is on its twelfth incubator round.

Preview APIs can change or disappear between releases, so do not ship library code that depends on them. Structured concurrency is the one to watch if you use virtual threads. Its API changed again here: the scope types got a third type parameter, Joiner.awaitAll() was removed, and onTimeout() became timeout(). If you wrote against the JDK 25 or 26 preview, expect a compile fix.

JFR redaction: small, but it fixes a real leak

JEP 536 redacts command-line arguments and the starting values of environment variables and system properties in Flight Recorder files, "before it leaves the process." The JEP's motivation is that these appear verbatim today, so a recording shared for debugging can leak a password passed as a flag or a token in an environment variable. If your team attaches .jfr files to tickets, read the JEP for how to configure it. I did not read the setup details.

Should you upgrade from Java 25 to 27?

Most production teams on Java 25 should test 27 and stay on 25. Java 25 is LTS, Oracle lists its Premier Support to September 2030, and Java 27 is superseded in six months. Move to 27 only if you want the new defaults now and can take a new release every six months.

If you are still on Java 17 or 21, the 25 to 29 path matters more than 27. Oracle's roadmap says updates of Oracle JDK 21 released from the October 2026 Critical Patch Update are planned under the Java SE OTN license, and that anyone who wants permissively licensed Oracle builds should be on Oracle JDK 25 or later. That applies to Oracle's builds. Other vendors have their own terms.

What is coming in JDK 28?

The JDK 28 page lists seven JEPs so far, last updated 28 September 2026. They include Value Objects (preview), a Simple JSON API (incubator), Ahead-of-Time Code Compilation, Shenandoah generational mode by default, and PEM Encodings with no "Preview" in its title. Targets can still change before the March 2027 release, so treat this as a watch list.

See the rest of our software coverage for other platform decisions. For the security side of a post-quantum move beyond Java, start in our security lane.