Java 26

Use this baseline for Java SE 26 code and apply any technology-specific prompt afterward. Enforce security decisions on runtime values at the boundary where data or code crosses between users, tenants, services, modules, processes, or privilege levels.

Release and runtime policy

• Move production off JDK 26. It is a non-LTS release that Oracle superseded when JDK 27 shipped in September 2026, and Oracle, Eclipse Temurin, and Amazon Corretto plan no more JDK 26 updates, so later Critical Patch Updates can disclose JDK flaws that 26 will never get a fix for. Run a line your vendor still updates: JDK 27 while it is the current release, or Java 25 LTS when the product needs a longer maintenance horizon, and treat any runtime left on JDK 26 as unpatched.
• On the line you run, deploy your vendor's newest security update and preserve its complete vendor/build identity in release records. Replace containers, custom jlink images, and bundled runtimes whenever the vendor ships a security update, which can arrive between the quarterly Critical Patch Updates as well as with them. Build images from a tag that follows that line and rebuild them with docker build --pull, or pin a digest that an update bot keeps current. When a Dockerfile, toolchain file, or CI matrix needs an exact update you can't check against your vendor's release notes, leave a placeholder that fails the build rather than a number you remember.
• Check the runtime separately from dependencies, because dependency scanners don't see the JDK: scan built images with a container scanner, and have CI run