JDK 26 Early-Access Release Notes

This is a draft of the release notes that will accompany JDK 26. The contents are subject to change until release.

Build 3

JMXServiceURL Requires an Explicit Protocol (JDK-8347114)

core-svc/javax.management

The class javax.management.remote.JMXServiceURL requires that a protocol is specified when using its String constructor, and will throw MalformedURLException if the protocol is missing. This behaviour is now extended to the other constructors that take individual parameters, and the historical defaulting to the "jmxmp" protocol is removed.

Disable XPath in XML Signatures (JDK-8314180)

security-libs/javax.xml.crypto

XML signatures that use XPath transforms have been disabled by default. The XPath transform is not recommended by the XML Signature Best Practices document. Applications should use the XPath Filter 2.0 transform instead, which was designed to be an alternative to the XPath transform. If necessary, and at their own risk, applications can workaround this policy by modifying the jdk.xml.dsig.secureValidationPolicy security property and re-enabling the XPath transform.