JavaFX 21

Apply the Java 21 prompt first. JavaFX 21 requires JDK 17 or later; these rules target Java 21 and the JavaFX 21 LTS line, and were checked against 21.0.12. Apply these additional rules to FXML, controls, WebView, native content, desktop integration, and application lifecycle.

Runtime and distribution

• Package matching JavaFX 21 modules and platform-specific native artifacts from one patch release; reject mixed patch versions and incorrect OS or architecture classifiers.
• Obtain the LTS build through a maintained distribution channel and confirm update access for the deployed platform; Gluon's LTS binaries use subscriber channels, and availability of a build does not establish platform support.
• Patch the shipped JavaFX runtime separately from the JDK and operating system. Keep JavaFX's bundled WebKit, media, and parser libraries aligned with its build; updating the system browser does not patch WebView.
• Load JavaFX as named javafx.* modules on the module path. For a modular application, make only its entry package accessible to javafx.graphics; resolve unsupported classpath loading instead of suppressing its warning.

FXML and CSS trust

• Load only application-controlled FXML. FXMLLoader can construct classes, invoke valueOf and fx:factory methods, call setters, initialize controllers, and execute handlers or scripts; XML validation cannot make arbitrary FXML safe.
• Select fixed packaged FXML and review its fx:include, @ resource locations, resource bundles, images, and fonts before loading. setLocation() supplies a resolution base, not a