Java News Roundup: JEPs for JDK 28, Azul Payara, Gatherers4j, Google ADK, Yupiik, Apache Camel CVEs

This week's Java roundup for October 12th, 2026, features news highlighting: three OpenJDK JEPs targeted for JDK 28; the October 2026 edition of Azul Payara; point releases of Gatherers4j, Yupiik Fusion, Google ADK for Java and Google ADK for Kotlin; and 38 CVEs resolved in Apache Camel.

OpenJDK

JEP 546, Adaptive Heap Sizing for ZGC, has been elevated from Proposed to Target to Targeted for JDK 28. This JEP proposes to "enhance the Z Garbage Collector to adaptively adjust the size of the heap based on the resources available, the application's needs, and the needs of neighboring applications contending for the same resources."

JEP 545, Faster Startup and Warmup with ZGC, has been elevated from Proposed to Target to Targeted for JDK 28. This JEP proposes to "improve application startup and warmup by enhancing the Z Garbage Collector to acquire and prepare physical memory more swiftly and efficiently in response to application needs."

JEP 543, Structured Concurrency, has been elevated from Proposed to Target to Targeted for JDK 28. This JEP proposes to finalize this feature, without change, after seven rounds of preview, delivered in JDK 21 through the upcoming release of JDK 27, and two rounds of incubator delivered in JDK 19 and JDK 20. This feature simplifies concurrent programming by introducing structured concurrency to "treat groups of related tasks running in different threads as a single unit of work, thereby streamlining error handling and cancellation, improving reliability, and enhancing observability."

JDK 28

Build 20 of the JDK 28 early-access builds was made available this past week featuring updates from Build 19 that include fixes for various issues. More details on this release may be found in the release notes.

For JDK 28, developers are encouraged to report bugs via the Java Bug Database.

Azul Payara

The release of Azul Payara 7.5.0, the October 2026 edition, includes Community Edition 7.2026.10, Enterprise Edition 6.43.0 and Enterprise Edition 5.92.0. Along with bug fixes and component upgrades, all three editions deliver new features such as: elevated permissions for SSH nodes are no longer required; and new properties, delete-jvm-option and delete-system-properties, for easier configuration management from the command line.

This release also addresses these CVEs:

• CVE-2026-2586, a Remote Code Execution (RCE) vulnerability that allows an attacker with access to the Administration Console to send malicious crafted requests to execute arbitrary operating system commands with the privileges of the application service user.
• CVE-2026-2587, also an RCE vulnerability in the server-side template rendering mechanism that allows an attacker to compromise the underlying host and enable capabilities such as reading/modifying data, executing arbitrary commands, persistence, and lateral movement.

Further details on this release may be found in the release notes.

Gatherers4j

The release of Gatherers4j 0.15.0 ships with bug fixes and new statistical-related gatherers such as: movingStatistics(), movingStatisticsBy(), runningStatistics(), and runningStatisticsBy() that emit an instance of the StatisticalSummary record for each element; and movingWeightedMean() and movingWeightedMeanBy(), that calculate the weighted moving average, with linear weights, or developer-provided weights, that are ordered oldest to newest. More details on this release, including breaking and behavioral changes, may be found in the release notes.

Yupiik

The release of Yupiik Fusion 1.2.0 provides bug fixes, documentation improvements, dependency upgrades and new features such as: an update to the CliDocumentationGenerator class to now use CliLauncher, and not its base class, Launcher, to use option markers that support multiple segments in commands; and a breaking change from an update to the HandlebarsCompiler class that extends its implementation to be closer to Handlebars. Further details on this release may be found in the release notes.

Google Agent Development Kit (ADK)

The release of ADK for Java 1.12.0 delivers bug fixes and new features such as: a refactor of the ContextCacheConfig class constructor that add new parameters, cacheIntervals and createHttpOptions, in place of the now deprecated maxInvocations parameter; and new workflow graph types that include the Node interface and corresponding implementations, BaseNode and Start classes, and Edge record. More details on this release may be found in the release notes.

Similarly, the release of ADK for Kotlin 1.4.0 ships with bug fixes and new features such as: a new EdgesDsl class to serve as a DSL for building workflow graphs; and a new ChatCompletions class to serve as a model backend for the OpenAI Chat Completions API and compatible endpoints. Further details on this release may be found in the release notes.

Apache Camel

The Apache Camel team has published that they have resolved a total of 38 Common Vulnerabilities and Exposures (CVEs) affecting numerous Camel components. 13 of these are rated as HIGH and twenty-five as MEDIUM. Of the 38 CVEs, 28 have been discovered by Claude as part of Project Glasswing and 10 were reported by security researchers. Developers are encouraged to upgrade to versions 4.23.0, 4.22.1 and 4.18.5.