13. Upgrade checklist: 25 to 27 (or to 26)

Ordered by "will stop a service from starting" first.

Grep for flags that no longer exist. -noverify, -Xverify:none and -noclassgc make a 27 JVM refuse to start (60). Look in Dockerfiles, JAVA_TOOL_OPTIONS, systemd units and start scripts.
Pin your collector in small containers. If nobody sets one, 27 gives you G1 on one CPU, where 26 gave you Serial (02). Decide on purpose, and set -Xmx or -XX:MaxRAMPercentage.
Run your tests once with --illegal-final-field-mutation=deny on 26 or later. Mocking, DI and serialisation libraries are the usual offenders (11).
Compile everything on 26 and 27. java.applet, JApplet and Thread.stop() are gone (73).
Test TLS through your real network path. JDK 27 clients send a 1573-byte ClientHello (04). If a middlebox objects, -Djdk.tls.namedGroups=x25519,secp256r1 restores the old behaviour.
Search for hard-coded object sizes. Estimators, capacity plans and tests that assume a 12-byte header (03).
Do not ship preview APIs from a library. Structured concurrency, lazy constants, PEM and primitive patterns changed shape on every release in the lane (12).
Check custom JFR redaction settings. A list without + replaces the defaults (09).
Rebuild AOT caches per JDK and per collector (11).
Decide whether to move at all. 26 and 27 are non-LTS: 26's premier support ends September 2026 and 27's in March 2027. Staying on 25 and planning for 29 is a legitimate answer (12).