Summary

Deprecate the Java Management Extension (JMX) Management Applet (m-let) feature for removal in a future release.

Problem

The m-let feature can load remote code. For this reason, some dynamic loading features are restricted. Specifically, the addURL and getMBeansFromURL methods cannot be invoked without a Security Manager. The Security Manager is a security feature that set out in early JDK releases to protect against the threat of malicious code, but is now a legacy feature, and was deprecated for removal in Java 17 by JEP 411. The dynamic loading features of m-lets will cease to be usable once the Security Manager is further degraded and eventually removed.

Solution

We will terminally deprecate the feature.

Specification

We will terminally deprecate the following classes, by annotating them with @Deprecated(since="20", forRemoval=true):

• javax.management.loading.MLet
• javax.management.loading.MLetContent
• javax.management.loading.PrivateMLet
• javax.management.loading.MLetMBean

The API docs will include the deprecation text:

This API is part of Management Applets (m-lets), which is a legacy feature that allows loading of remote MBeans. This feature is not usable without a Security Manager, which is deprecated and subject to removal in a future release. Consequently, this API is also deprecated and subject to removal. There is no replacement.