Liberica JDK 21.0.13+11: Release Notes

JDK-8189441

Summary: Define algorithm names for keys derived from KeyAgreement

Description: With the proposed new Key Algorithms section in the Java Security Standard Algorithm Names Specification, the KeyAgreement::generateSecret method is linked to the section to specify the algorithm names that users can provide. Additionally, the potential truncation of the shared secret length to align with the specified algorithm name was clarified. An implementation decides which secret key algorithms from the Key Algorithms section to support and may throw an exception if an unsupported algorithm is specified.

JDK-8298387

Summary: Implement JEP 497: Quantum-Resistant Module-Lattice-Based Digital Signature Algorithm

Description: ML-DSA is a quantum-resistant digital signature algorithm selected by the National Institute of Standards and Technology (NIST) to ensure the security of cryptographic systems in the post-quantum era. ML-DSA is defined and its three standardized parameter sets (ML-DSA-44, ML-DSA-65, and ML-DSA-87) as Java Security Standard Algorithm Names. Implemented KeyPairGenerator, KeyFactory, and Signature implementations of ML-DSA with these standardized parameter set in the SUN security provider. Created new NamedParameterSpec constants for ML-DSA-44, ML-DSA-65, and ML-DSA-87. The algorithms are added to the KeyPairGenerator, KeyFactory, and Signature rows of the SUN provider table of the JDK Security Providers Guide.

JDK-8333867

Summary: SHA3 performance can be improved

Description: The performance of the MessageDigest implementations that belong to the SHA3 family (SHA3-224, SHA3-256, SHA3-384, and SHA3-512) has been improved by 6-27%, depending on digested message length and on the platform used. An additional 30-40% can be experienced on AVX-512 capable platforms due to new intrinsic implementations on that platform.

JDK-8347938

Summary: Add Support for the Latest ML-KEM and ML-DSA Private Key Encodings

Description: The JDK now encodes ML-KEM and ML-DSA private keys in PKCS #8 format using the DER-encoded ASN.1 CHOICE formats defined in Section 6, 'Private Key Format' of RFC 9935 and Section 6, 'Private Key Format' of RFC 9881. Two new security properties, jdk.mlkem.pkcs8.encoding and jdk.mldsa.pkcs8.encoding, control the encoding used when generating new keys with a KeyPairGenerator or when translating keys with a KeyFactory. Valid values are seed, expandedKey, and both (case-insensitive). If a system property of the same name is also specified, it supersedes the security property value. All three formats are supported when decoding previously encoded private keys with a KeyFactory. The default encoding for newly generated ML-KEM and ML-DSA private keys is seed. Applications that require a particular private-key encoding can configure the relevant security property or equivalent system property.

JDK-8351412

Summary: ML-KEM Performance Improved

Description: The performance of the ML-KEM key generation, encapsulation, and decapsulation operations has been improved significantly, 1.9 - 2.7 times depending on operation type and platform, on the aarch64 and AVX-512 platforms.

JDK-8354305

Summary: SHAKE128 and SHAKE256 MessageDigest algorithms

Description: Two new MessageDigest algorithms, SHAKE128-256 and SHAKE256-512, have been added to the SUN provider. These are fixed-length versions of the SHAKE128 and SHAKE256 Extendable-Output Functions (XOFs) defined in NIST FIPS 202. For more information, see the SUN Provider.

JDK-8387123

Summary: Remove LuxTrust Global Root CA

Description: The following root certificate has been removed from the cacerts keystore: alias name "luxtrustglobalrootca [jdk]" Distinguished Name: CN=LuxTrust Global Root, O=LuxTrust s.a., C=LU

JDK-8388214

Summary: Update Timezone Data to 2026c

Description: Briefly: Alberta moved to permanent -06 on 2026-06-18; Morocco moves to permanent +00 on 2026-09-20; More integer overflow bugs have been fixed in zic.

JDK-8392377

Summary: Update Timezone Data to 2026d

Description: Briefly: Canada’s Northwest Territories moved to permanent -06 on 2026-08-21; Obsolescent settings like TZ='EST5EDT' now conform better to POSIX; Fix security, performance and porting bugs in zic and localtime.

JDK-8392538

Summary: Align the JDK with Microsoft’s new timezone names for British Columbia/Alberta

Description: Microsoft announced a new timezone name for British Columbia, per https://techcommunity.microsoft.com/blog/dstblog/interim-guidance-for-british-columbia-time-zone-changes-2026/4544988 JDK timezone data needs to be aligned with the registry key updates to allow a Windows user to select a local timezone.

JDK-8393337

Summary: Update Timezone Data to 2026e

Description: Briefly: Manitoba moves to permanent -05 on 2026-10-31.

JDK-8393848

Summary: Align the JDK with Microsoft’s new timezone name for Manitoba

Description: Microsoft announced a new timezone name for Manitoba, per https://techcommunity.microsoft.com/blog/dstblog/interim-guidance-for-manitoba-permanent-dst-2026/4562488 JDK timezone data needs to be aligned with the registry key updates to allow a Windows user to select a local timezone.

JDK-7067310

3 tests from closed/javax/sound/sampled caused BSOD on win 7 x86

JDK-8189441

Define algorithm names for keys derived from KeyAgreement

JDK-8247690

RunTest does not support running of JTREG manual tests

JDK-8298387

Implement JEP 497: Quantum-Resistant Module-Lattice-Based Digital Signature Algorithm

JDK-8298390

Implement JEP 496: Quantum-Resistant Module-Lattice-Based Key Encapsulation Mechanism

JDK-8306281

function isWsl() returns false on WSL2

JDK-8307574

ClipIsRunningAfterStop.java failed with "../nptl/pthread_mutex_lock.c:81: pthread_mutex_lock: Assertion `mutex→data.__owner == 0' failed."

JDK-8308395

javax/sound/sampled/Clip/ClipFlushCrash.java timed out

JDK-8310331

JitTester: Exclude java.lang.Math.random

JDK-8316391

(zipfs) ZipFileSystem.readFullyAt does not tolerate short reads

JDK-8317126

Redundant entries in Windows tzmappings file

JDK-8331159

VM build without C2 fails after JDK-8180450

JDK-8333867

SHA3 performance can be improved

JDK-8334502

gtest/GTestWrapper.java fails on armhf due to LogDecorations.iso8601_utctime_test

JDK-8338587

Internal XOF Methods for SHAKE128 and SHAKE256

JDK-8338686

App classpath mismatch if a jar from the Class-Path attribute is on the classpath

JDK-8340327

A common framework to support public key algorithms with standard parameter sets

JDK-8340493

Fix some Asserts failure messages

JDK-8341527

AVX-512 intrinsic for SHA3

JDK-8341625

Improve ZipFile validation of the END header

JDK-8342002

sun/security/tools/keytool/GenKeyPairSigner.java failed due to missing certificate output

JDK-8342003

ProblemList sun/security/tools/keytool/GenKeyPairSigner.java

JDK-8342442

Static ACVP sample tests

JDK-8343698

Linux x86_64 lto build gives a lot of warnings and fails lto-wrapper: fatal error: make returned 2 exit status

JDK-8343739

Test java/awt/event/KeyEvent/ExtendedKeyCode/ExtendedKeyCodeTest.java failed: Wrong extended key code

JDK-8343788

Provide means to alter lib/tzmappings entries on Windows

JDK-8345057

ML_KEM NamedParameterSpec constants removed by ML-DSA integration

JDK-8345512

Remove wrapper functions for intrinsics in PQC algorithms

JDK-8345533

Switch ML-DSA implementation to FIPS 204 final

JDK-8347606

Optimize Java implementation of ML-DSA

JDK-8347608

Optimize Java implementation of ML-KEM

JDK-8347938

Add Support for the Latest ML-KEM and ML-DSA Private Key Encodings

JDK-8348561

Add aarch64 intrinsics for ML-DSA

JDK-8349017

Update ML tests to verify against ACVP 1.1.0.38 version

JDK-8349721

Add aarch64 intrinsics for ML-KEM

JDK-8349759

Add unit test for CertificateBuilder and SimpleOCSPServer test utilities

JDK-8350589

Investigate cleaner implementation of AArch64 ML-DSA intrinsic introduced in JDK-8348561

JDK-8351034

Add AVX-512 intrinsics for ML-DSA

JDK-8351412

Add AVX-512 intrinsics for ML-KEM

JDK-8352565

Add native method implementation of Reference.get()

JDK-8353478

Update crypto microbenchmarks to cover ML-DSA, ML-KEM, and HSS algorithms

JDK-8354305

SHAKE128 and SHAKE256 MessageDigest algorithms

JDK-8354926

Remove remnants of debugging in the fix for JDK-8348561 and JDK-8349721

JDK-8356051

Update SignatureUtil.java with the new KnownOIDs

JDK-8356085

AArch64: compiler stub buffer size wrongly depends on ZGC

JDK-8359735

[Ubuntu 25.10] java/lang/ProcessBuilder/Basic.java, java/lang/ProcessHandle/InfoTest.java fail due to rust-coreutils

JDK-8361125

Fix typo in onTradAbsence

JDK-8361950

Update to use jtreg 8

JDK-8364106

Include java.runtime.version in thread dump output

JDK-8365426

[macos26] Graphics2D tests fail on new macOS 26

JDK-8365498

jdk/jfr/event/os/TestCPULoad.java fails with Expected at least one event

JDK-8367008

Algorithm identifiers for HmacSHA* should always have NULL as params

JDK-8368677

acvp test should throw SkippedException when no ACVP-Server available

JDK-8368694

PKCS11-NSS generic keys generated by DH have leading zeroes stripped

JDK-8369020

Test compiler/intrinsics/TestLongUnsignedDivMod.java completed and timed out

JDK-8369488

Update to use jtreg 8.1

JDK-8371893

[macOS] use dead_strip linker option to reduce binary size

JDK-8372546

UnixMultiResolutionSplashTest.java fails intermittently on Ubuntu_24.04

JDK-8372615

Many container tests fail when running rootless on cgroup v1

JDK-8372757

MacOS, Accessibility: Crash in [MenuAccessibility accessibilityChildren] after JDK-8341311

JDK-8373677

Clear text HttpServer connection could fail fast if receiving SSL ClientHello

JDK-8374343

Fix SIGSEGV when lib/modules is unreadable

JDK-8374755

ML-KEM’s 12-bit decompression can be simplified on aarch64

JDK-8374886

CAInterop.java#microsoftrsa2017 test fails as EE certificate does not specify OCSP responder

JDK-8375125

assert(false) failed: "Attempting to acquire lock NativeHeapTrimmer_lock/nosafepoint out of order with lock ConcurrentHashTableResize_lock/nosafepoint-2 — possible deadlock" when using native heap trimmer

JDK-8375294

(fs) Files.copy can fail with EOPNOTSUPP when copy_file_range not supported

JDK-8376355

Update to use jtreg 8.2.1

JDK-8377983

(zipfs) ZipFileSystem.initCEN needlessly reads END header

JDK-8377991

TestLimitsUpdating.java fails with runtime exception even after JDK-8370492 is fixed

JDK-8377992

(zipfs) Align ZipFileSystem END header validation with the ZipFile implementation

JDK-8378180

Compiling OpenJDK with C23 C-Compiler gives warning: initialization discards ‘const’ qualifier from pointer target type

JDK-8378506

[macOS] Window content not updated when rendering to multiple windows

JDK-8379515

draft-ietf-lamps-kyber-certificates is now RFC 9935

JDK-8380223

Refactor test/jdk/sun/util/resources TestNG tests to JUnit

JDK-8380715

Enhance PKCS5 padding

JDK-8380993

[REDO] Incorrect Interpretation of POSIX TZ Environment Variable on AIX

JDK-8381379

Support std/dstOffset attributes in CLDR’s metazone definitions

JDK-8381771

Add a check for DNS label not to end with a hyphen

JDK-8381937

Make exceptions in Java_sun_security_mscapi_CKeyPairGenerator generateCKeyPair more specific

JDK-8382063

Jtreg test javax/swing/SwingWorker/TestDoneBeforeDoInBackground.java fails

JDK-8382178

Enhance TLS certificate handling

JDK-8382378

Improve C2 loop transformations

JDK-8382407

Enhance LDAP Lookups

JDK-8383047

Enhance LDAP logins

JDK-8383076

Enhance SASL Authentication

JDK-8383281

Enhance MD5 Digesting

JDK-8383301

Enhance WebRowSets

JDK-8383439

Enhance HTTP Client Response Handling

JDK-8383530

Enhance Javadoc Searching

JDK-8383611

assert(count == os::processor_count() + 1) failed: invalid enumeration!

JDK-8383679

Enhance Certificate Name Checks

JDK-8383699

Enhance XPath Expressions

JDK-8383745

Enhance HTTP Server

JDK-8383756

Enhance Network Clients

JDK-8384021

Enhance Certificate Constraint Checking

JDK-8384031

Enhance XML Processing

JDK-8384163

(so) SocketChannel.connect and finishConnect() exception messages could be improved

JDK-8384165

Improve ciphertext handling

JDK-8384445

Enhance JPEG loading

JDK-8384455

Enhance DataFlavor

JDK-8384468

Enhance jpackage Packaging

JDK-8384654

Enhance Template Handling

JDK-8384664

Enhance Image Handling

JDK-8384688

Enhance jmod handling

JDK-8384736

Enhance JShell 8387235: JShell tests failing

JDK-8384746

Enhance Preferences

JDK-8384771

Enhance TLS handshakes

JDK-8384804

JMX remote bootstrap tests fail on Windows

JDK-8384872

Enhance HTTP Client

JDK-8384930

Enhance jstatd

JDK-8385209

Enhance HTTP client caching

JDK-8385249

Enhance diagnostic sessions

JDK-8385260

Enhance SOCKS5 support

JDK-8385454

Provide more NUMA related information in hsinfo/hserr files

JDK-8385476

Enhance MIDI file handling

JDK-8385508

Bump update version for OpenJDK: jdk-21.0.13

JDK-8385584

CAInterop.java#buypassclass3ca fails with Intermediate Root CA not found in the chain

JDK-8386013

Enhance EventListenerList

JDK-8386187

Enhance font rendering

JDK-8386273

Some javax/sound/sampled tests fail on systems with high CPU core number and running with high concurrency

JDK-8386345

Remove redundant @requires from TestGarbageCollectionEventWithZMinor

JDK-8386515

Enhance HTTP server parsing

JDK-8386525

Enhance HTTP Server Handler

JDK-8386535

Improve HTTP headers

JDK-8386551

Windows build broken because of MSys2/Make update

JDK-8386552

Enhance GIF loading

JDK-8386578

double_keccak stub does not set its return value on x86

JDK-8386783

WebRowSet empty elements read value of previous element

JDK-8386923

Enhance TLS Extensions

JDK-8387075

RemoteHostImpl constructor correction (jstatd)

JDK-8387123

Remove LuxTrust Global Root CA

JDK-8387152

Enhance krb5 tokens

JDK-8387217

Enhance krb5 client

JDK-8387238

Enhance Kerberos validation

JDK-8387593

Using XOR mode to clear the content leaves some traces in metal

JDK-8387625

Add "dt_socket" to CheckedFeatures.notImplemented for Windows/ARM64

JDK-8387985

sun/tools/jstat shell tests fail on platforms that do not support ParallelGC

JDK-8388214

(tz) Update Timezone Data to 2026c

JDK-8388431

[21u] Backport of JDK-8352565 misses previous vm symbol to be deleted

JDK-8389492

[21u] java/io/Serializable/records/ProhibitedMethods.java fails after JDK-8307843 backport in othervm mode

JDK-8389648

[TEST_BUG] java/awt/TextField/CaretPositionTest/CaretPositionTest.java fails in OL-9

JDK-8390380

Cherry-pick metazone changes from CLDR to support tzdata2026c for JDK update releases

JDK-8390388

Cherry-pick tz attributes from newer CLDR data for jdk25u and earlier

JDK-8390400

Enhance C2 comparisons

JDK-8391256

TestZoneTextPrinterParser.java assertion fails with expected: <Mountain Standard Time> but was: <Mountain Daylight Time>

JDK-8391807

Inconsistent TimeZone Names Displayed across JDK release trains

JDK-8392072

Follow-on fix for Improve certification checking

JDK-8392377

(tz) Update Timezone Data to 2026d

JDK-8392519

Cherry-pick metazone changes from CLDR for tzdata2026d, for JDK update release

JDK-8392538

Align the JDK with Microsoft’s new timezone names for British Columbia/Alberta

JDK-8393337

(tz) Update Timezone Data to 2026e

JDK-8393344

Cherry-pick metazone changes from CLDR to support tzdata2026e for JDK update releases

JDK-8393848

Align the JDK with Microsoft’s new timezone name for Manitoba

JDK-8394265

[21u] Add explicit zone offset test for America/Rainy_River

JDK-8281384

Random chars on paste from Windows clipboard

JDK-8324326

Update ICU4C to 74.2

JDK-8329874

JavaFX debug builds fail on Linux

JDK-8340564

[macOS] Intermittent build failure in native font with parallel compilation

JDK-8361644

Update ICU4C to 77.1

JDK-8361648

Update Glib to 2.84.3

JDK-8367374

JavaFX debug builds fail on Windows

JDK-8379561

Remove UNICODE related code from GLib

JDK-8380556

Update WebKit to 625.1

JDK-8383209

Improve JavaFX Scripting Support

JDK-8383219

Enhance JavaFX Document Loading

JDK-8383229

Enhance JavaFX Image Loading

JDK-8383252

Enhance JavaFX DnD

JDK-8383322

Enhance JavaFX Clipboard

JDK-8383332

Improve JavaFX Input Methods

JDK-8383333

Improve JavaFX Drag and Drop

JDK-8384522

Update libxml2 to 2.15.3

JDK-8384809

Update GStreamer to 1.28.3

JDK-8385198

Enhance JavaFX Resource Loading

JDK-8386486

Improve graphics rendering

JDK-8386859

WebView crashes when calling document.startViewTransition()

JDK-8387337

GlassClipboard: Replace deprecated hash_map and hash_set

JDK-8388451

Additional WebKit 625.1 fixes from WebKitGTK 2.52.5

JDK-8388783

Custom String data cannot be read from the clipboard

JDK-8389515

Memory leak in dshowwrapper - decoded buffers delivered by CSink are never unmapped

JDK-8389783

Crash in JavaFX native glass toolkit during Timer shutdown

JDK-8390085

Change JavaFX release version to 21.0.13 in jfx21u

JDK-8390652

Additional WebKit 625.1 fixes from WebKitGTK 2.52.6

JDK-8390756

[jfx21u] incorrect backport breaks gradle build