By Java 27’s release candidate lands August 20. General availability follows September 15. After years of watching structured concurrency accumulate preview versions and the Vector API notch its twelfth incubation, this cycle finally delivers meaningful finalized features — the kind that change runtime behavior automatically when you upgrade. Here is what ships final, what is still cooking, and what you need to check before September.
The Features That Actually Finalize
Five JEPs ship as final in Java 27. No flags, no previews, no incubation caveats. These are on by default the moment you upgrade.
Compact Object Headers: Free Heap Savings
Object headers on 64-bit JVMs just shrank from 96 bits to 64 bits. That sounds like an implementation detail — it is not. The SPECjbb2015 benchmark shows 22% less heap consumption, 8% less CPU time, and 15% fewer garbage collections. Real-world expectations are more conservative but still compelling: 10–20% heap reduction, 5–10% throughput gain. Amazon has been running this feature in production on hundreds of services via a JDK 17 backport. It works, and it is now on by default in Java 27. You do not need to change a line of code.
Applications with many small objects — anything with heavy use of strings, boxed primitives, or short-lived DTOs — benefit most. If your heap is already sized tight, expect to either reduce the allocation or absorb the savings as reduced GC pressure.
Post-Quantum TLS 1.3: Harvest-Now-Decrypt-Later Is Addressed
Java 27 becomes one of the first standard runtimes to ship post-quantum cryptography in TLS by default. The implementation uses hybrid key exchange — combining classical ECDH with ML-KEM (CRYSTALS-Kyber, NIST FIPS 203) so that both algorithms must be broken to compromise a session. Three algorithms are supported: X25519MLKEM768 (default, highest on the preference list), SecP256r1MLKEM768, and SecP384r1MLKEM1024.
This matters now because of harvest-now-decrypt-later attacks: adversaries are capturing encrypted TLS traffic today intending to decrypt it once a cryptographically capable quantum computer exists. If your application handles data that needs to remain confidential for more than five years, post-quantum TLS is no longer optional. Java 27 makes enabling it zero-configuration.
G1 as Default GC Everywhere: Check Your Containers
Previously, the HotSpot JVM selected Serial GC when it detected fewer than one CPU or less than 1792 MB of RAM — the typical profile of a Lambda function or a constrained container. Starting with Java 27, G1 is the default regardless of resource constraints.
For most deployments this is a straightforward improvement. G1 has closed the gap with Serial in constrained environments over the past several releases. But if you are running Java in tight resource limits and have tuned around Serial GC’s predictable behavior, test before you upgrade. The escape hatch is -XX:+UseSerialGC, which still works. Also note that MinHeapFreeRatio changes from 40 to 0 and MaxHeapFreeRatio from 70 to 100, which effectively disables heap resizing based on those ratios under G1.
JFR Data Redaction: One Flag Between You and a Credential Leak
JDK Flight Recorder can now mask sensitive data before it leaves the JVM process. The target is command-line arguments, environment variables, and system properties — exactly where API keys, passwords, and tokens tend to live.
Configuration is a single JVM flag using glob patterns:
java -XX:FlightRecorderOptions=redact-key=*PASSWORD*,*TOKEN*,*SECRET* MyAppMatched values are replaced with [REDACTED] in the recording. For teams doing SOC 2 or running observability tooling that captures JFR data, this eliminates a class of credential-leak incidents that are embarrassingly common in JVM environments.
PEM Encodings API: Stop Writing Certificate Parsers
Java now has a standard API for reading and writing PEM-format files. Private keys, certificates, CRLs, CSRs — all handled without BouncyCastle or custom parsing code. The PEM Encodings API (JEP 535) supports round-trip encoding and covers all standard Java cryptographic objects. If your application manages TLS certificates, client auth, or any PKI operations, this replaces the boilerplate you have been copying between projects.
Still in Preview: The Long Game
Four features in Java 27 remain in preview or incubation, and the gap is getting harder to ignore. Structured concurrency is in its seventh preview. The Vector API is in its twelfth incubation. Lazy constants are in their third preview. Primitive type patterns are in their fifth.
These features are not broken — they are genuinely useful today and the implementations are stable. The previews exist because the OpenJDK team is waiting on Project Valhalla, which needs to land before the Vector API can graduate and before lazy constants and structured concurrency can fully finalize their APIs. Valhalla has been “close” for a while. Java 29, the next LTS in 2028, is the realistic target for finalizing most of this work.
If you are adopting preview features, keep your upgrade cadence tight. The structured concurrency API (JEP 533) changed again in preview 7 — awaitAll() is gone, joiners now throw ExecutionException instead of FailedException, and there is a new type parameter on StructuredTaskScope. These are the right changes, but they are changes.
What to Do Before September 15
Java 27 is not an LTS release — Java 25 holds that title, and the next LTS is Java 29 in 2028. That said, the finalized features in 27 are worth testing against your applications now. Download the early-access build at jdk.java.net/27 and run your test suite. The main things to verify:
- Container and Lambda deployments running below 1 CPU or 1792 MB — validate G1 behavior
- Any custom GC tuning that assumed
MinHeapFreeRatio/MaxHeapFreeRatiodefaults - JFR integrations — redaction is additive, but verify recording content
- Preview feature usage from Java 25/26 — API changes in structured concurrency require updates
The five finalized features are conservative, well-tested, and deliver real runtime improvements without code changes. That is exactly the right kind of release to upgrade to on a short cycle. Full feature list and early-access builds are available at the JDK 27 project page.
