If one sign of maturity is making better choices, then Java has grown up a fair bit in its version 27 release Tuesday. “JDK 27 is the release where Java stops asking you to opt in to good defaults and simply turns them on,” wrote backend engineer Arvind Kumar, on his education site Codefarm. Better default settings may not be groundbreaking, but they do make life easier for developers because they mean coders have fewer things to change. Nor should users have to grapple with new features, particularly if they are not of interest. Java 27 succeeds on both counts. Built from the now-completed Java 27 specification, JDK 27 is a short‑term release that won't get long-term support. It includes four new features, or JEPs (JDK Enhancement Proposals) that are ready for production, none of which, Kumar points out, require any immediate changes in developers' code. The release includes another five new features offered as previews for further incubation. Headers get compact In Java 27, compact headers are now available by default (JEP 534). Up until now, the developer had to set them with a flag. Now, no additional action is required. Traditionally, a Java object header takes up 96 bits in a memory heap, much of which is rarely used. With Java 27, the default is a 64-bit header. Turns out the header had too much empty space. Four bytes doesn’t sound like a change to worry over, but across millions of live objects it can lead to considerable memory savings. A run on the SPECjbb2015 Java benchmark standard found that toggling to a 64-bit header resulted in 22% less heap space and 8% less CPU time. The smaller headers appear to work in production. Amazon already runs hundreds of production services with the diminutive compact object headers. SAP has already switched to compact object headers as the default for the company’s OpenJDK fork, SapMachine. Even in its smaller size, this new layout reserves some space for future projects, such as 4 bits for Project Valhalla which aims to bring value objects to Java. Java's overseers don’t want to toss the 96-bit header layout, at least for the time being. But now developers must raise a flag if they want to use it. Quantum-proofing cryptography Looking ahead to the arrival of quantum computing, Java maintainers have implemented “post-quantum hybrid key exchange,” based on TLS 1.3 (JEP 527). Java now offers three new “hybrid” ways of exchanging keys between Java clients, servers and external TLS-compliant endpoints. Each of these approaches, which are options alongside the existing key exchange protocols, combines a traditional Ephemeral Elliptic-Curve Diffie-Hellman (ECDHE) algorithm with the NIST ML-KEM post‑quantum key exchange algorithm. The idea is to prepare now for future quantum attacks when the keys to traditional key exchanges could be easily cracked with quantum computing. Malicious attackers are already saving encrypted sessions with a "harvest now, decrypt later" mindset. Taking out the trash, in a good way JDK 27 also tidies up its garbage collectors, the tools that quietly identify and reclaim unused memory. It switched out the default trash bin for constrained environments – Serial – to the overall default garbage collector, called Garbage-First or G1. Garbage collectors relieve developers from manually performing this task and potentially messing it up (usually). But it comes with a cost. Aggressive memory management adds overhead. So different garbage collectors have been built to meet different performance requirements regarding throughput, latency, footprint, and startup time. Recent performance improvements in G1 effectively rendered Serial GC unnecessary, Java's bosses argue. Serial was a single-threaded app built to run on a single CPU, making it well-suited to embedded and other resource-limited environs (especially with clients with less than 1792MB of memory). Thanks to optimization over the years, “G1's performance is now sufficient to replace Serial in all situations in which the JVM would previously have selected Serial,” the maintainers write in JEP 523. With this change, embedded developers will no longer have to add explicit flags to the command line during startup. Even better, it will correct cases where G1 should have been assigned in the first place, such as for containerized apps. “A chunk of containerized Java apps has been running on [Serial] all this time, even though no one consciously made that decision,” wrote PVS-Studio technical author Egor Pishii in a post. The switchover will also help unify telemetry data collection a bit more. Preparing Java 28 The remaining production-ready feature is in-process data redaction (JEP 536), in which Java’s Flight Recorder removes all sensitive details before the recording is finalized. The previews that come with this release include lazy constants (JEP 531), pattern primitive types (JEP 532), structured concurrency (JEP 533), and a set of cryptographic objects (JEP 538). There’s also a vector API (JEP 537) still in the incubation stage. We’ll see all of these again, hopefully in a more polished form, in a later release. Work is already underway for Java 28, due in March 2027: Expect a simple JSON API as an incubating project as well as a revised Shenandoah garbage collector. ®

The October 23 ship date of Apple’s iPhone Duo grows nigh, so developers wanting to optimize their iPhone apps for the foldable will need to get to grips with its new display behaviors and form factor. “A fold is a UI event with backend consequences,” Atharva Deosthale, Appwrite developer advocate, wrote in an introductory blog post. “Folding and unfolding is part of normal device use, so apps need to preserve state and respond cleanly when the display changes.” The iPhone Duo, which Apple introduced last week, is a smartphone with two screens: a squat 5.4-inch (diagonal) outer display on top of the case and the larger 7.6-inch inner display within. The display’s contents automatically (and stylishly) move to the visible screen when the device is opened or snapped shut. Apple has published a repository of technical documentation to help devs prepare for the new form factor. Time to study up. An ever-shifting canvas The foldable fondleslab will run iOS 27.1, and will run unaltered iPhone apps, but in the same way regular iPhone apps run on the iPad: awkwardly. Devs need to learn some new moves to style their apps to truly make Apple’s mobile device look good. The foldable form factor means that the user may start work on an app on the top screen, and when the device opens, the app should appear seamlessly on the larger display (the display ratio remains the same across both screens). The phone doesn’t have to lie flat for the inner screen to be fully used; it can also fold into a “tabletop posture,” where half the screen is flat and the other half sits upright, like a little laptop. Or it could be fashioned into a partially opened “book posture,” with the fold running vertically. Maybe for privacy? Who knows what other ways people, with their endless ingenuity, will interact with these gadgets. Both screens have a 120 Hz adaptive refresh rate, thanks to Apple’s ProMotion technology. So any transitions within the app, and resizing of the app itself, need to be almost Walt Disney animation-level smooth - while maintaining state. The device can accommodate two apps simultaneously running on the screen, through “Split View,” so apps will also have to learn to share the screen nicely. To address this new topology, Apple is updating its Xcode IDE; the 27.1 beta will be available later this month. The backend will need some love too The iPhone Duo screen is a different world for a number of reasons. Size is no longer a value, but a dynamic range, Deosthale noted. An app’s available size needs to be read at layout time and adjusted through the app’s lifetime as its screen allocation changes. Some apps will work better in this environment than others, Deosthale noted. Apps with fixed layouts and hardcoded dimensions, or that use view controllers that reload on size change, can appear stretchy. “Those need work,” he wrote. Compared with the iPhone Pro Max, the Duo offers a bit more space, with a 7.6-inch inner display versus 6.9 inches. It’s wide enough that a single column stretching across the entire display won’t impress anyone. Now’s the chance to add in a detail pane or sidebar, side-by-side presenter and viewer modes, Deosthale suggested. And don’t let the app just disappear features, data or other miscellanea when the user switches screens. That will just come off as cheesy. Snapping the unit shut mid-task means the app needs to preserve its state, along with the user’s session identity, as the interface moves to the outer display. Try not to move components around too much when the display switches, leaving the user seeking some option anew. In the technical docs, Apple calls this keeping a “consistent experience.” Contrary to the traditional iPhone layout, some of the device’s system controls have moved from the bottom toward the side of the display, which, in landscape mode, is a sensible change that leaves more, albeit asymmetrical, vertical space. However, it is up to developers to ensure their apps aren’t covered by system controls. While this may not directly relate to the form factor itself, the device runs an A20 Pro system-on-a-chip, built at 2-nanometer scale, with a 6-core CPU, a 7-core GPU wired for matrix math, and a dual 16-core neural engine for ML work. All this horsepower means you can run local ML inference on the device itself. Perhaps add a button to destroy humanity? It’d be the perfect antidote for a rough day at work. If Apple developers have any questions about working with foldable displays, they can ask their Android brethren who have been wrangling foldables for almost a decade now.®

The maintainers of CPython have backed off from making Rust a required dependency for the Python reference implementation, focusing on the less intrusive task of building an optional Rust API for internal Python development. The move “sidesteps a lot of the concerns that people brought up,” Rust Programming Manager Tomáš Šedovič explained at RustConf, held in Montréal last week. Šedovič and others from Rust have been working with the CPython core developers to smooth the integration between the two environments. CPython’s revised approach eschews a more aggressive push to use Rust in Python, an approach that roiled the Linux kernel community’s adoption of Rust last year. The tasty dish is still rejected by the unwilling palate Last November, Python programmer Emma Smith floated the idea of incorporating Rust support into Python, initially for writing extension modules, but with the overall plan of making Rust a required dependency in CPython so it could be used throughout the CPython code base. This would have been similar to the relationship between Rust and the C programming language, upon which CPython is largely built (hence the name). C brings its share of security dangers when it comes to memory, which must be allocated and deallocated manually in code. The memory-safe Rust eliminates this entire class of errors at compile time, hence its interest to the CPythonistas. But, as fellow vulture Liam Proven noted at the time, the mandatory inclusion of Rust created a number of issues. Not all Python implementations were built on platforms that supported Rust. Plus, building Rust itself requires Python, creating cyclic dependencies in the build process. And you have to factor in the usual curmudgeonly reluctance that comes with any forced upgrade. So, in May, Smith amended the proposal to drop the mandate to make Rust a required dependency for CPython, kicking that down the road for a future proposal. Instead, Smith pitched the idea of modifying CPython so its devs could write optional extension modules. They could use Rust to build the functionality if they wanted, but it’d also be cool if they chose not to opt in. Even Python creator Guido van Rossum agreed this easier approach was the way to go, commenting in the proposal: “We all know that a full rewrite in Rust won’t work, but starting to introduce Rust initially for less-essential components, and then gradually letting it take over more essential components sounds like a good plan.” The devil’s details Since then, work has continued on incorporating Rust into the build process, and designing a Rust API that would allow Rust crates, or libraries, to be used to build Python itself. The API is planned for the 3.16 Python release (due October 2027), which will also include the Rust zlib compression library as a test crate. Python and Rust will each have to make some adjustments to work happily together, Šedovič noted. Developers from each camp have been in talks about how Rust could better accommodate Python’s concerns. One element needed from Rust is support for the GCC (GNU Compiler Collection), necessary to CPython’s “long tail” of obscure platforms it supports. The two languages also differ in how they build both standard libraries and individual dynamic shared libraries, which must be reconciled. Python will need some sort of cross language “sanitizer” support to ensure unsafe memory states don’t crop up between how the two languages handle memory allocations. Fortunately, several efforts are already underway along these lines, such as BorrowSanitizer, thanks to the same problem that bedevils C/C++ integrations with Rust. The most complex challenge will be augmenting Rust's Drop trait so that Python objects can receive runtime context when being deallocated from memory. This one will take some major think-em-ups from Rust engineers, he said. Python may also borrow a few innovations from Rust. The original proposal from last November praised Cargo as an “excellent build system.” In fact, it does the work of several separate functions in the Python universe, automating the entire development lifecycle. Not only does Cargo download dependencies, it also compiles and links them to other libraries, and tests them. With Python, you need separate project initialization, build, testing, and publishing tools to do the same tasks. Python is already following Cargo’s lead here with uv, a unified packaging and project manager (written in Rust). It’ll be interesting to see what other Rust innovations Python cops over time. Van Rossum even joked that perhaps CPython may need to be renamed “CRPython.” ®

When Microsoft's developers and engineers sit down to code, they can now choose to work in Rust, which Redmond has added to its list of canonical languages. “Rust now is a Tier One language at Microsoft, and that just means that it sits among C++, C# and TypeScript as the best supported languages for internal development in the company,” explained Victor Ciura, Microsoft principal engineer for the Rust tooling team, during a keynote talk today at this year’s annual RustConf, being held this week in Montréal. Ciura said Microsoft has “paved a path” of tools and processes that support local Rust development across the entire software development lifecycle. Rust is no stranger at Microsoft and is already present in over 100 Microsoft project repositories. The company has built Oxidizer, a set of crates to build scalable services in Rust, which have been used to build and refine the Microsoft 365 (M365) core services such as Outlook, Word, Excel, OneDrive, and SharePoint. The Copilot tech stack also owes quite a bit to Rust. But the really messy work still lies ahead. Given the recent Windows Patch Tuesday patch deluge, no doubt one of the largest uses for Rust will be shoring up leaky C/C++ Windows code. This is the work Rust was made for. Mozilla developer Graydon Hoare created Rust as a side project in 2006 chiefly as a high-performance language that, unlike C and C++, guarded against memory bugs. Rewriting programs in Rust to improve performance and minimize bugs has since become a common chore for project leaders, who have Rustified everything from databases to package managers, often with the help of AI. New digs Redmond has already done considerable work making Rust comfy on Microsoft Visual C++ (MSVC), its native platform for compiling Windows binaries. Notably, company engineers built rustc_codegen_utc, a custom Rust compiler code-generation backend that wires the rustc compiler directly into MSVC’s internal toolchain for Windows. “Connecting rustc to that backend lets Rust build on the same platform investment, with perfect compatibility out of the box, rather than requiring a parallel implementation of every Windows-specific capability,” wrote Ciura in a blog post that details Redmond's rusty efforts. “The result is a unified code generation platform for Rust and C++ on Windows.” Dangling pointers and foreign code Even with the tight Rust integration, Microsoft engineers will have their work cut out for them. One of the recurring themes of this year’s RustConf is grappling with the dangerous “unsafe” territory that comes when mixing Rust and C++ code. While the Rust compiler can flag memory errors, it typically doesn’t cover pointers into the C++ memory allocations. Still, Redmond running towards Rust is a welcome development. In his 2025 RustConf keynote, Microsoft Azure CTO Mark Russinovich noted that ~70 percent of Windows CVEs are memory issues. “One of the things that I realized a long time ago is that no matter how much we really want to make C and C++ better, we can't make it as good as what Rust starts with," he said. ®

Tailwind CSS may still be open source, but it’s not independent anymore: It’s now a Shopify product. Tailwind Labs CEO Adam Wathan shared news of Shopify’s acquisition of his company in a blog post Thursday. Wathan said that he chose to sell to Shopify because the ecommerce platform was an early adopter of Tailwind CSS, and will serve as an ideal place for his open-source web development platform to “be developed in service of a real product.” “I believe deeply in Shopify's mission to help more people start, run, and grow their own business,” Wathan added. “Tailwind is a very important part of the stack at Shopify, and they're invested in making sure it's actively maintained and continues to improve and adapt for how the ways we build are changing.” For those unfamiliar with Tailwind CSS, it’s an open source framework that simplifies web development by providing utility classes that can be applied directly to elements in HTML documents. Traditional CSS, on the other hand, often involves maintaining separate stylesheets containing rules that are applied to HTML elements. It’s a useful tool, and one that’s installed over 110 million times a week, per Wathan, if you can believe that. But as we've seen several times, the rise of AI is making it hard for the platform's overlords to make ends meet. Wathan said in January that AI coding tools had started eating into Tailwind Labs' bottom line to the degree that he was forced to lay off three employees. He blamed the fact that vibe coding tools have begun to come between his product and potential customers, causing traffic to plummet and income to dry up. So Shopify has come to the rescue to save Tailwind CSS from languishing in maintenance hell like other open source projects. “We're joining Shopify to give Tailwind a stable long-term home where it will be actively maintained for the millions of people who depend on it,” Wathan explained in his blog post. The precise details depend on what type of Tailwind CSS user you are. “Nothing changes with Tailwind CSS or any of our other open-source projects,” Wathan said. “Everything will always be MIT-licensed, and our team will continue to lead and maintain these projects for the community with the support of Shopify.” But users of Tailwind’s premium services might find things changing, as Wathan said his team will no longer be trying to grow the business. That means Tailwind Plus, the company’s paid, UI-based package of templates and other tools, and ui.sh, Tailwind’s package of AI skills designed to help non-coders build user interfaces, are going the way of the dodo. “We're closing sign ups for new customers to focus on Tailwind CSS at Shopify,” Wathan explained. Existing customers who’ve paid for access to those tools and other paid Tailwind Labs offerings will still have access, Wathan stressed. We reached out to get more details on future support for those paid products, and will update this post if we hear back. ®

The popular JavaScript package manager pnpm, already known for its speedy downloads, has further cut installation times by up to 90 percent thanks to a complete rewrite in Rust. Yet the freshly released version 12 of pnpm should not cause consternation while upgrading, its maintainer says. “Upgrading should not feel like a migration. The commands, flags, settings, and lockfile format of pnpm 11 all carry over, and the documentation covers both versions,” wrote Zoltan Kochan, the current lead maintainer of pnpm. In the project’s own benchmarks, pnpm 12 installed a sample uncached package in 5.19 seconds, compared to the 8.22 seconds pnpm 11 required and the 47.7 seconds npm itself required. The project team also built a registry server in Rust, called pnpr, which improves performance even further. In the above test, the installation took only 3.37 seconds with pnpr on the backend. A new Rust core binary, on which work started in April, eliminates a lot of the overhead that comes from routing filesystem work through Node.js. This new version is 65.9 percent Rust and 33.5 percent TypeScript, according to the GitHub stats. “Package installation is dominated by fetching metadata and tarballs, unpacking files, resolving dependency graphs, and linking packages into node_modules, making it a natural target for native code and parallelism,” wrote Sarah Gooding, vice president of communications for security provider Socket, in a blog post. Gooding also noted that the project benchmarked pnpm against Bun and Yarn, but the results were removed due to testing SNAFUs. Nonetheless, she noted the software cut install times by up to 90 percent in some cases. A faster npm Developer Rico Sta. Cruz originally created pnpm in 2016 as a faster alternative to npm (Node Package Manager), JavaScript’s de facto package manager, which devs used to find and download libraries and tools. GitHub acquired the open source npm software and repository in 2020. Npm garnered a reputation for being both sluggish and hungry for disk space, thanks to its generous practice of downloading all needed dependencies onto users’ machines, regardless of whether they were duplicates. Pnpm’s secret sauce is content-addressable storage. If you need a single library for 100 different applications, pnpm downloads it only once, and downloads another copy only if the developer specifies a different version. Like npm, pnpm still draws from the official npm repository, but arguably works better than npm for many. Many devs also like that the lockfile describing the package’s dependency tree was more readable thanks to its use of YAML. The 2025 State of JavaScript survey showed that pnpm was by far the most popular package manager for JavaScript monorepos, a party that also included Nx, Lerna, Yalc, Turborepo and even npm’s built-in Workspaces. About 38 percent (3,840) of 10,251 surveyed developers used the package manager. Rust for JavaScript Rewriting applications in Rust seems to be a favorite activity these days, as the language is known for speedy performance unhampered by garbage collection. In the Web app ecosystem alone, the Bun framework just got an AI-fueled Rust makeover, Tailwind CSS version 4 got a new Rust engine called Oxide, and the Vite framework now speeds along thanks to a Rust-built JavaScript bundler called Rolldown. “It is a bit of [an] indictment on Node for having poor dx” (developer experience), wrote Darcy Clarke, CEO of JavaScript package management platform provider vlt, in an X message, about the Rust rewrite of pnpm. “It was faster to rewrite pnpm in rust than to migrate to esm” (ECMAScript modules), replied pnpm's Kochan, agreeing with Clarke’s sentiment. The software’s GitHub page still points at the last major release, pnpm 11.25, so existing users will have to update to the v12 branch specifically (“pnpm self-update next-12” will get you there). ®