: The SunPKCS11 provider was upgraded to support version 2.40, adding algorithms like AES/GCM and RSASSA-PSS signatures.
| Area | Change | Risk | |--------------------------|--------|------| | java.time parsing | Strict ResolverStyle for uuuu | Low | | java.util.TimeZone | New tzdata – mismatched historical offsets | Medium | | rmi.activation | Deprecated but present – no behavioral change | None | | cacerts | Added 3 root CAs (Sectigo, TrustCor) | Low | | formatting | No change | - | | JarFile signatures | Enforces SHA-1 disabled if jdk.jar.disabledAlgorithms includes SHA-1 | Medium | java runtime 1.8 u241