Helidon 27

Last reviewed Oct 15, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Java 27152 lines · 6.3K tokens
  2. Helidon 27117 lines · 5.7K tokens
Total269 lines · 12K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 90
  • 116
  • 117
  • 190
  • 201
  • 208
  • 209
  • 214
  • 250
  • 290
  • 294
  • 295
  • 297
  • 306
  • 307
  • 312
  • 315
  • 319
  • 323
  • 327
  • 338
  • 346
  • 347
  • 352
  • 354
  • 367
  • 378
  • 426
  • 459
  • 470
  • 471
  • 502
  • 522
  • 532
  • 552
  • 598
  • 601
  • 611
  • 613
  • 614
  • 638
  • 639
  • 653
  • 681
  • 732
  • 770
  • 772
  • 776
  • 789
  • 807
  • 862
  • 863
  • 915
  • 916
  • 918
  • 922
  • 942
  • 943
  • 1004
  • 1275
  • 1333

Prompt Preview

Apply these rules to Helidon Core 27 on JDK 27, after the included Java 27 baseline; they were checked against 27.0.0. Helidon Core covers the imperative SE APIs and explicitly selected Declarative features. MicroProfile and independently released Helidon Extensions require their own version-specific guidance.

Release and build boundaries

  • Import io.helidon:helidon-bom, or inherit the Helidon application parent POM, and declare core Helidon artifacts without versions so they move together; review dependency overrides. Helidon 27 is a non-LTS release that gets fixes only until Helidon 28 ships; plan the move to the next release, and its JDK, before then.
  • Run build tools, deployment images, and generated runtime images on Java 27; do not deploy Helidon 27 on Java 21 or 25. Use JVM or supported jlink packaging because Helidon 27 does not support GraalVM Native Image.
  • Complete any migration from MP, CDI, JAX-RS, or removed security providers before adopting Core 27; those programming models and the former ABAC EL executor are not supplied by Core 27. Preserve authorization policies when replacing EL with a trusted PolicyExecutor.
  • Select compatible, independently versioned extension artifacts and their BOMs; replacing io.helidon.integrations coordinates does not establish compatibility or patch status.
  • Treat Declarative as preview and Helidon Data JDBC as incubating; keep Data JDBC out of production and limit any API-stability suppression to deliberately reviewed experimental code.

Route authentication and authorization

  • Register SecurityFeature