If your applications use MicroProfile OpenTracing, this release needs work before you upgrade. Support has been removed from Azul Payara Server and Azul Payara Micro 7.4.0 and 6.42.0 and the specification defines no migration path: @Traced has no MicroProfile Telemetry equivalent, and explicit instrumentation moves to the OpenTelemetry @WithSpan annotation. Applications need re-instrumenting first.
That is the one blocking item in the cycle. Everything else is upside and by the end of this post you will know which items apply to the line you run and what order to tackle them in.
MicroProfile 7.1 Arrives on the Supported Lines
The headline is MicroProfile 7.1. It shipped in Payara Community in August; this cycle it reaches both supported lines, with the MicroProfile OpenAPI API at 4.1.1 and the OpenTelemetry SDK at 1.65.0. That upgrade is what brings the OpenTracing removal with it, which is why the two land together.
Azul Payara Server and Micro 7.4.0 is the fourth monthly release since Payara 7 reached general availability in May. Server 7.4.0 remains Jakarta EE 11 certified across Full Platform, Web Profile, and Core Profile. Beyond MicroProfile 7.1, it adds a JSON-formatted HTTP access log, moves Hazelcast to 5.7.0, and fixes a blank Admin Console page after deployment and a cluster instance on an SSH node being unreachable from the DAS.
Azul Payara Server and Micro 6.42.0 continues the Jakarta EE 10 line and also moves to MicroProfile 7.1, so the OpenTracing note applies here too. Azul Payara Server and Micro 5.91.0 stays on Jakarta EE 8 and MicroProfile 4.1 and is unaffected. Azul Payara Server and Micro 4.1.2.191.59 receives the security fixes for the branch.
A Security Patch Across Every Branch
CVE-2026-68497, a resource exhaustion vulnerability in jackson-databind, is fixed on every supported branch, alongside a Hazelcast upgrade to shaded Jackson 2.18.6 or later. Azul is a registered CVE Numbering Authority under CISA and DHS oversight, and patches are backported to every supported version on a published monthly schedule. There is no reason to delay upgrading based on the major-version line you run.
Easy Migration From the 5 and 6 lines
Three items in this release touch Payara deployment descriptors: recognition of payara- descriptors for Payara 5, a fix for Payara 6 descriptors stripping deprecated elements that applications still depend on, and the return of managed executor definitions in Payara descriptors. Together with the major-versioned descriptor support added in July, the descriptor layer is becoming a compatibility bridge rather than a migration obstacle.
The jakarta.* namespace is stable between Jakarta EE 10 and Jakarta EE 11. Existing Jakarta EE 10 applications move to Azul Payara Server 7 by upgrading the runtime, not by rewriting the codebase.
Jakarta Agentic AI Reaches Payara Micro and Embedded
Payara Community 7.2026.9 (download here) carries the same fixes and upgrades as the Azul Payara 7 line, plus one addition of its own: the Jakarta Agentic AI preview that debuted in August now runs on Payara Micro and Payara Embedded. The specification is still at Milestone 1 and the API may change, which is precisely why building against it now is worth doing.
If you run MicroProfile OpenTracing on the 7 or 6 line, re-instrumenting against OpenTelemetry is now blocking work rather than future work. If you do not, this is a straightforward upgrade with a security patch you want.
The full breakdown of the release can be found on Foojay,
Frequently Asked Questions
What replaced MicroProfile OpenTracing?
MicroProfile OpenTracing was removed from the MicroProfile platform at MicroProfile 6.0 and superseded by MicroProfile Telemetry, which is built on OpenTelemetry. There is no automatic migration path between them: the @Traced annotation has no MicroProfile Telemetry equivalent, and explicit instrumentation uses the OpenTelemetry @WithSpan annotation instead. Applications using the OpenTracing APIs need re-instrumenting before moving to a MicroProfile 7.1 runtime such as Azul Payara Server 7.4.0 or Azul Payara Server 6.42.0.
Which Jakarta EE version does each Payara release line support?
Azul Payara Server & Micro 7 support Jakarta EE 11, with Azul Payara Server 7 certified across the Full Platform, Web Profile, and Core Profile. Azul Payara Server and Micro 6 support Jakarta EE 10, and Azul Payara Server and Micro 5 support Jakarta EE 8 on the javax.* namespace. All three currently receive monthly security and bug-fix releases.
Can Jakarta EE 10 applications run on a Jakarta EE 11 application server?
Yes. The jakarta.* namespace is stable between Jakarta EE 10 and Jakarta EE 11, so an application built for Jakarta EE 10 deploys on a Jakarta EE 11 runtime without namespace changes. Moving from Azul Payara Server 6 to Azul Payara Server 7 is a runtime upgrade rather than a code rewrite for most applications. Migration assessments are available from Azul for teams planning the move.
How long do application server vendors support older major versions?
Practice varies widely, and many vendors treat upgrading to the current major version as the remedy for a security issue. Azul backports security patches across every supported Azul Payara branch on a published monthly schedule, currently spanning Azul Payara Server and Micro 7, 6, 5, and 4.
What is Jakarta Agentic AI?
Jakarta Agentic AI is a vendor-neutral Jakarta EE specification for building and running AI agents on Jakarta EE runtimes, where an agent is a CDI bean annotated with @Agent and a large language model is injected like any other dependency. The specification is at Milestone 1 and the API may still change. A preview is available in Payara Community 7.2026.9, which runs it on Payara Server, Payara Micro, and Payara Embedded.
