I have been cautioned twice in security forums about the use of Java on my Windows 8 PC (it seems it might be responsible for the daily creation of a particular and large temporary file). The latest reply advises me to either remove it completely or have it in a separate browser for use only with those applications that require it. The version on my PC is Java 7 update 55. I was informed the latest versions are Java 7 update 60 or Java 8 update 5. I wonder what other users of JOSM have to say on the matter.
Most Java applications, including JOSM, run locally on your computer and don’t interact with your browser at all. These are just as safe as any other local applications.
In addition, there is also the option to let Websites run Java code in your browser. This is risky because there have been some big security holes recently, and you should disable this feature in your browser. Doing so does not affect JOSM at all.