JavaFX 27

Apply these rules when writing or reviewing JavaFX 27 desktop applications, after the included Java 25 baseline. JavaFX 27 requires JDK 25 or later. Apply the matching Java baseline as well when deploying on a newer JDK.

Runtime and application boundaries

• Pin the JavaFX Java modules and platform-native artifacts to the same release, with the correct operating system and architecture. Rebuild and redistribute bundled runtimes for relevant JavaFX security updates; updating the host JDK alone does not replace packaged WebKit, media, image, or font components.
• Load JavaFX from named javafx.* modules on the module path. Include javafx.fxml, javafx.web, and javafx.media only when required, and keep incubating jfx.incubator.richtext functionality behind an explicit dependency and import policy.
• Run the desktop process with ordinary user privileges. Do not rely on SecurityManager, policy files, or historical applet permissions to contain FXML, plugins, or native parsers; the supported JDKs cannot provide that sandbox. Use a separate process with operating-system restrictions when untrusted processing needs isolation.
• Authorize privileged operations in the application service and remote backend that performs them. Treat Node.setDisable, Node.setVisible, table filtering, and hidden menu items as presentation controls; they do not authorize controller calls or API requests.
• Keep javafx.scene.robot.Robot behind application-owned, authorized operations: it can inject keyboard and mouse input and capture screen pixels without a Scene. Never expose raw