Java SE Development Kit 7, Update 221 Release Notes

Azul offers certified open source OpenJDK builds under the Zulu moniker. Java 20 was released on 21 March 2023.[382] All JEPs were either incubators or previews. Java 5 was first available on Apple Mac OS X 10.4 (Tiger)[34] and was the default version of Java installed on Apple Mac OS X 10.5 (Leopard). In addition to the language changes, other changes have been made to the Java Class Library over the years, which has grown from a few hundred classes in JDK 1.0 to over three thousand in J2SE 5. Entire new APIs, such as Swing and Java2D, have been introduced, and many of the original JDK 1.0 classes and methods have been deprecated. Some programs allow conversion of Java programs from one version of the Java platform to an older one (for example Java 5.0 backported to 1.4) (see Java backporting tools).

Without a clear specification of the behavior of this method, there is a risk that the key derivation function will not have some security property that is expected by the client. This release disables server side HTTP-tunneled RMI connections by default. The previous behavior can be re-enabled after due consideration of any impact by setting the runtime property sun.rmi.server.disableIncomingHttp to false.

Update Release Notes

Java offers the rich user interface, performance, versatility, portability, and security that today’s applications require. A static field representing a singleton instance of the REIWA era in java.time.chrono.JapaneseEra is added as a private field in this update. The singleton instance is not directly accessible, instead it can be obtained by calling JapaneseEra.of(3) and JapaneseEra.valueOf(“Reiwa”).

• The following sections summarize changes made in all Java SE 7u95 BPR releases.
• If the property is set to the empty String or “true” (case-insensitive), trust anchor certificates can be used if they do not have proper CA extensions.
• For that reason, the JIT compiler has been disabled and it won’t compile any more methods and won’t generate more compiled code.
• For a more complete list of the bug fixes included in this release, see the JDK 7u161 Bug Fixes page.
• In order to determine if a release is the latest, the Security Baseline page can
  be used to determine which is the latest version for each release family.

The system property jdk.tls.client.cipherSuites can be used to customize the default enabled cipher suites for the client side of SSL/TLS connections. In a similar way, the system property jdk.tls.server.cipherSuites can be used for customization on the server side. The following sections summarize changes made in all Java SE 7u211 BPR releases. The following sections summarize changes made in all Java SE 7u221 BPR releases.

Server JRE 8

To check if a weak algorithm or key was used to sign a JAR file, one can use the jarsigner binary that ships with this JDK. Running “jarsigner -verify” on a JAR file signed with a weak algorithm or key will print more information about the disabled algorithm or key. Running jarsigner -verify -verbose on a JAR file signed with a weak algorithm or key will print more information about the disabled algorithm or key. To improve the strength of SSL/TLS connections, exportable cipher suites have been disabled in SSL/TLS connections in the JDK by the jdk.tls.disabledAlgorithms Security Property. C) Set the jdk.crypto.KeyAgreement.legacyKDF system property to “true”. This will restore the previous behavior of this KeyAgreement service.

For DSA keys, the default signature algorithm for keytool and jarsigner has changed from SHA1withDSA to SHA256withDSA and the default key size for keytool has changed from 1024 bits to 2048 bits. The DSA KeyPairGenerator implementation of the SUN provider no longer implements java.security.interfaces.DSAKeyPairGenerator. Applications which cast the SUN provider’s DSA KeyPairGenerator object to a java.security.interfaces.DSAKeyPairGenerator can set the system property “jdk.security.legacyDSAKeyPairGenerator”. If the value of this property is “true”, the SUN provider will return a DSA KeyPairGenerator object which implements the java.security.interfaces.DSAKeyPairGenerator interface. This legacy implementation will use the same default value as specified by the javadoc in the interface.

Previews and Incubators for Later JDK Releases

Please note that fixes from prior BPR (7u111 b32) are included in this version. Please note that fixes from prior BPR (7u121 b32) are included in this version. In addition, connecting to an HTTP server using SPNEGO usually involves keeping the underlying connection alive and reusing it for further requests to the same server. In some applications, java 7 certifications it may be desirable to disable all caching for the HTTP SPNEGO (Negotiate/Kerberos) protocol in order to force requesting new authentication with each new request to the server. Please note that fixes from prior BPR (7u131 b31) are included in this version. Please note that fixes from prior BPR (7u141 b33) are included in this version.

• In applications where there is a security manager, the new restrictions are opt-out.
• In 2021, Microsoft started distributing compatible “Microsoft Build of OpenJDK” for Java 11 first then also for Java 17.
• This removes the user’s ability during the JDK installation to specify a custom directory in the GUI for the public JRE.
• GraalVM for JDK 17 will receive updates under the GFTC, until September 2024.
• In addition, signatures which contain constructed indefinite length encoding will now lead to IOException during parsing.

The RMI Registry built-in serial filter is modified to check only the array size and not the component type. Array sizes greater than the maxarray limit will be rejected and otherwise will be allowed. The JDK uses the Java Cryptography Extension (JCE) Jurisdiction Policy files to configure cryptographic algorithm restrictions. Previously, the Policy files in the JDK placed limits on various algorithms. This release ships with both the limited and unlimited jurisdiction policy files, with unlimited being the default.