JavaFX 26.0.2

Apply the Java 25 prompt first. These rules cover JavaFX 26.0.2 with a patched JDK 25; JavaFX 26 requires JDK 24 or later. Apply these rules to FXML, scene graphs, WebView, desktop data exchange, media, asynchronous work, and packaged applications.

Runtime and deployment boundaries

• Confirm vendor security maintenance before retaining JavaFX 26.0.2 in production, and migrate when coverage ends. Rebuild and redistribute bundled runtime images for JavaFX security fixes, including WebKit, media, font, and image libraries.
• Load matching JavaFX Java and native artifacts for the target OS and architecture as named javafx.* modules. Include only required modules in the jlink image, and verify the installed jpackage application uses that image and the intended launcher options.
• Sign final installers with platform tooling, using jpackage --mac-sign on macOS, and verify update metadata and payload signatures before replacing bundled JavaFX libraries, the runtime image, or application code.
• Grant native access specifically with --enable-native-access=javafx.graphics, adding javafx.media and javafx.web when used; do not grant every classpath dependency native access through ALL-UNNAMED merely to silence warnings.
• Use operating-system isolation for untrusted extensions or rendering helpers. JavaFX 26 has removed FXPermission and provides no Security Manager sandbox; module openings, native-access grants, and signed installers do not make hostile FXML or Java code safe.

FXML, controllers, and stylesheets

• Load only trusted application FXML through