Chapter 3. Red Hat build of OpenJDK features 3.1. New features and enhancements This section describes the new features introduced in this release. It also contains information about changes in the existing features. Note For all the other changes and security fixes, see https://mail.openjdk.java.net/pipermail/jdk-updates-dev/2021-April/005860.html 3.1.1. Added LDAP channel binding support for Java GSS/Kerberos A new JNDI environment property com.sun.jndi.ldap.tls.cbtype is added to enable TLS Channel Binding data in LDAP authentication over SSL/TLS protocol to the Windows AD server. The only valid value at present is tls-server-end-point , where channel binding data is created on the base of the TLS server certificate. See RFC-5929 and the java.naming module description for further details. For more information, see JDK-8258824 . 3.1.2. Added two HARICA root CA certificates The following two HARICA root certificates are added to the cacerts truststore: Alias Name: haricarootca2015 Distinguished Name: CN=Hellenic Academic and Research Institutions RootCA 2015, O=Hellenic Academic and Research Institutions Cert. Authority, L=Athens, C=GR Alias Name: haricaeccrootca2015 Distinguished Name: CN=Hellenic Academic and Research Institutions ECC RootCA 2015, O=Hellenic Academic and Research Institutions Cert. Authority, L=Athens, C=GR For more information, see JDK-8260597 . 3.1.3. Disabled TLS 1.0 and 1.1 versions TLS 1.0 and 1.1 versions of the TLS protocol that are no longer considered secure and are superseded by more secure and modern TLS 1.2 and 1.3 versions. TLS 1.0 and 1.1 versions are now disabled by default. If you encounter issues, you can re-enable the versions (at your own risk) by removing TLSv1 or TLSv1.1 from the jdk.tls.disabledAlgorithms security property in the java.security configuration file. For more information, see JDK-8256490 . 3.1.4. Enhanced jdeps --print-module-deps reports transitive dependencies The jdeps --print-module-deps , --list-deps , and --list-reduce-deps options are enhanced as follows: By default, they perform transitive module dependence analysis on libraries on the classpath and module path, both directly and indirectly, as required by the given input JAR files or classes. Previously, they only reported the modules required by the given input JAR files or classes. The --no-recursive option can be used to request non-transitive dependence analysis. By default, they flag any missing dependency, i.e. not found from classpath and module path, as an error. The --ignore-missing-deps option can be used to suppress missing dependence errors. Note that a custom image is created with the list of modules output by jdeps when using the --ignore-missing-deps option for a non-modular application. Such an application, running on the custom image, might fail at runtime when missing dependence errors are suppressed. For more information, see JDK-8214213 . 3.1.5. XML declaration is not followed by a new line The DOM Load and Save LSSerializer does not have an explicit control for whether or not the XML Declaration ends with a new line. In this release, a JDK implementation specific property http://www.oracle.com/xml/jaxp/properties/isStandalone and corresponding System property jdk.xml.isStandalone are added to control the addition of a new line and act independently without having to set the pretty-print property. This property can be used to reverse the incompatible change introduced in Java SE 7 Update 4 with an update of Xalan 2.7.1 where a newline is omitted when pretty-print is required. For more information, see JDK-8249867 and the java.xml module-summary.

Commands: