GlassFish 9.0.0 Milestone 3 Ships Full Jakarta Security and CDI Support
GlassFish 9.0.0 M3, the third milestone toward the next major release of the Eclipse reference implementation of Jakarta EE, is now available. The milestone delivers full implementations of Jakarta Security 5.0-M2, Jakarta Faces 5.0-M5, and Jakarta CDI 5.0-RC1, bringing the server closer to feature-complete support for the upcoming Jakarta EE 12 platform.
Also notable in this milestone is first-class support for applying the Jakarta Annotations @RolesAllowed annotation directly to Jakarta RESTful Web Services endpoints, letting developers declare role-based access control on JAX-RS resources without wiring up a separate security layer. Combined with the CDI 5.0-RC1 integration, this milestone gives teams tracking Jakarta EE 12 a realistic preview of how security annotations and dependency injection will interact in the next generation of the platform.
For teams running GlassFish in staging environments to validate against upcoming Jakarta EE 12 specifications, M3 is a meaningful checkpoint — the security and CDI stacks are now stable enough to exercise real application code rather than just the reference test suite.
Read more — InfoQ
Open Liberty 26.0.0.8 Patches Three Denial-of-Service Vulnerabilities
IBM shipped Open Liberty 26.0.0.8 with security fixes for three CVEs: CVE-2026-50645, CVE-2026-9171, and CVE-2026-15057, all classified as denial-of-service vulnerabilities. The release is a routine but important update for any team running Open Liberty in production, since DoS-class CVEs in an application server can be triggered remotely without authentication in many configurations.
Beyond the security patches, 26.0.0.8 continues Open Liberty's monthly cadence of incremental fixes rather than introducing new features, consistent with the project's pattern of separating security response from feature delivery. Teams on Open Liberty should prioritize this update over waiting for the next feature release, particularly for internet-facing deployments.
Read more — InfoQ
Jakarta Agentic AI 1.0 Delivers First Milestone Release
The newly formed Jakarta Agentic AI specification project delivered its Milestone 1 release, along with an updated project website. Jakarta Agentic AI 1.0 aims to give the Jakarta EE ecosystem a standard way to build and deploy AI agents on top of existing enterprise Java infrastructure — CDI for dependency injection, Jakarta RESTful Web Services for exposing agent endpoints, and Jakarta Security for authorization — rather than requiring teams to bolt on separate agent frameworks.
This is an early milestone, so the API surface is still taking shape, but it signals that the Jakarta EE Working Group sees agentic AI as a platform-level concern rather than something left entirely to third-party libraries like LangChain4j. Enterprise Java teams already standardized on Jakarta EE should watch this specification closely, since it is likely to become the default on-ramp for agent development in that ecosystem over the next several milestones.
Read more — InfoQ
Links & Sources
You May Also Enjoy
