Java Core on foojay.io - Friends Of OpenJDK

Hello Java 27! Have You Been Working Out?

Tue, 15 Sep 2026 08:00:00 +0000

It’s been six months since we saw a new Java release, and this new edition seems to be ready to flex its muscles. With numerous improvements to performance and security, Java 27 is like that friend that you haven’t seen all summer, and when you finally see them again it’s clear that they spent a lot of time in the gym!

This post focuses on everything that has been added in this release, giving you a brief introduction to each of the features. Where applicable the differences with Java 26 are highlighted and a few typical use cases are provided, so that you’ll be more than ready to start using these features after reading this.

Foojay Podcast #101: Java 27 in Practice: Smaller Heaps, Smarter Defaults, and Valhalla on the Horizon

Mon, 14 Sep 2026 06:11:42 +0000

JDK 27 arrives on 15 September 2026, and it is a feature release rather than a Long-Term Support one. That distinction matters less than it sounds: as Simon Ritter points out, all OpenJDK releases are delivered the same way, and “long-term support” is a property of the binary distributions you install, not of the platform itself. What JDK 27 does have is two changes that switch on by default and cost you nothing but the upgrade. Compact object headers shrink the per-object header from 64 bits to 32, which the JEP measures at a 22% reduction in heap and 8% in CPU on SPECjbb2015 — and because it is internal to the JVM, a JAR you built years ago benefits without a single line changing. Alongside it, G1 becomes the default garbage collector everywhere, including the small, single-core machines that used to fall back to the serial collector.

One Base URL, Many Coding Agents: What an OpenAI-Compatible Gateway Looks Like From java.net.http

Wed, 09 Sep 2026 16:09:53 +0000

Somewhere in every coding agent there is an HTTP client. Claude Code, Codex, Cursor, Cline, OpenCode: strip away the terminal UI or the editor pane and each of them serializes a conversation into JSON, POSTs it to a base URL with an API key in a header, and streams the answer back. The client owns the prompt assembly, the tool loop and the rendering; the model sits on the far side of that socket.

Masking a JVM thread dump without breaking the analysis

Wed, 09 Sep 2026 07:32:00 +0000

A few weeks ago I posted on r/java about detecting virtual thread pinning from a plain thread dump. The technical discussion was fine. The comment that stuck with me had nothing to do with pinning: “the problem isn’t taking the dump, it’s that uploading a production dump to a third-party site is against policy”. Not a preference. Policy. And the person saying it was right.

I run ThreadMine, a hosted thread dump analyzer, so that comment describes my own product. This article is about what I built in response: a small open-source CLI that rewrites the dump on your machine before it goes anywhere, in a way that keeps the analysis working. It’s called tm-anon, it’s MIT, and it works with any analyzer, mine included. The interesting part isn’t the tool, it’s the constraint: you can’t just strip everything, because the analyzer needs most of what’s in there.

Debugging Is Invariant Discovery: What One Kafka Session Taught Us About AI Agents

Tue, 08 Sep 2026 14:14:36 +0000

Every Java team has a sentence like this one somewhere:

Any operation on a TID must go through the single asynchronous path and must not let TMS and EMV drift apart.

It is the kind of rule that is obvious once said and invisible until then. A terminal ID (TID) in a payments system, an asynchronous pipeline that updates two downstream systems, and the requirement that the two never disagree. Nothing in the type system enforces a rule like that, and no single class owns it. Rules of this kind live between consumers, services and stores.

Community Spotlight: BoxLang Express Brings Node-Style HTTP to the JVM

Tue, 08 Sep 2026 11:25:18 +0000

If you’ve spent years in Spring Boot, Micronaut, or Jakarta EE, “web framework” usually means a servlet container, an embedded Tomcat or Netty, a build step, and a fat jar before anything answers a request. What if you could skip all of that and still be on the JVM?

BoxLang Express , a new community module built entirely by developer Robert Zehnder of KISDigital, does exactly that. It’s built directly on com.sun.net.httpserver.HttpServer, a class that’s been sitting in the JDK since Java 6, so there’s no embedded server to configure and nothing extra on the classpath for the HTTP layer itself. boxlang server.bxs is the whole deployment story.

“Commit created” — but it isn’t: why the agent’s word needs external verification, and what the mistake costs

Tue, 08 Sep 2026 08:54:03 +0000

A detailed report reads like proof. The agent lists the files it touched, names the branch, quotes a commit hash, adds a test count and closes with “done”. The work has a shape. The shape looks right. You have six more tickets.

The report is model output. The commit, if it exists, lives in .git. The file, if it exists, lives on disk. The build result lives in a process exit code and a run log. The chat window is none of those places, and it can only vouch for itself.

Did Your AI Agent Ever Run a Debugger? One JVM Bug, Two Agent Runs

Thu, 03 Sep 2026 13:48:32 +0000

Java developers reach for the debugger without thinking about it. Set a breakpoint, run the failing test, look at the variables, then decide what to change.

Most AI coding agents I have watched skip that step. They read the stack trace, read the source, and propose a patch. The reasoning can look excellent and still be a guess about a program nobody ran.

I wanted to know what that guess costs. So I took one real JVM bug, one model, one prompt, and ran it twice with two debugging workflows. Here is what the two transcripts show.

BoxLang 1.16.0 Released!

Tue, 25 Aug 2026 13:57:47 +0000

BoxLang 1.16.0 is here, closing 50 issues across new features, improvements, and bug fixes. The theme running through this release is control: control over how HTTP clients are created and reused, control over what happens when a request fails, control over how much data a response is allowed to buffer, control over when Java classpaths reload, and tighter alignment with CFML behavior in the edge cases when doing migrations.

Offline Crypto Address Validation in Java

Sat, 22 Aug 2026 08:43:04 +0000

Backend validation often starts with simple questions.

Is the input empty? Does it have the expected shape? Can it be parsed? Does it belong to the selected domain?

Crypto wallet addresses are no different, except the formats vary across chains and simple regular expressions are rarely enough.

If a Java backend accepts crypto withdrawal addresses, address-book entries, CSV imports, support-tool input, or transaction preflight requests, it should reject clearly invalid addresses before calling RPC nodes, explorers, exchange APIs, or internal money-movement systems.

New Between-Quarters Security Updates for Java: What CSPUs Mean for Your Release Pipeline

Mon, 27 Jul 2026 07:31:11 +0000

In an announcement on the OpenJDK Updates Mailinglist on July 20, 2026, Rob McKenna explained a change in the Oracle security release cycle for JDK builds. They plan to deliver security updates for the Oracle JDK as part of (some) monthly Critical Security Patch Updates (CSPUs) .

This brings more exact info, after an earlier message on April 26, 2026, in which Oracle announced the acceleration of Vulnerability Detection and Response. In that article they introduced the idea of monthly Critical Security Patch Updates (CSPU) across all their products. At that moment, it was not clear if this also applied to the Java releases, and how this would impact the normal quarterly cycle of Critical Patch Updates (CPUs).

Azul Zulu July 2026 Quarterly Update Released

Thu, 23 Jul 2026 12:35:26 +0000

Every three months your production JDKs fall further behind on security patches. Azul closes that gap today with the July 2026 quarterly update for Azul Zulu Builds of OpenJDK, covering Java 26, 25, 21, 17, 11, 8, 7, and 6.

The Quarterly Update Cycle

Every three months, in January, April, July, and October, the OpenJDK project ships security patches, bug fixes, and improvements for all supported Java versions. This predictable schedule lets teams plan Java updates and keep production environments secure.

Your Loom App Quietly Became a Thread Pool Again: A Field Guide to Virtual Thread Pinning

Thu, 16 Jul 2026 07:43:16 +0000

The incident that taught me to respect pinning looked like nothing. A service freshly migrated to virtual threads, a load test that plateaued at about 420 requests per second no matter how much traffic we threw at it, CPU sitting at 9%, zero errors, zero warnings, nothing in the logs. The machine had 8 cores, and the one downstream HTTP call in the hot path took about 19 ms. Do the arithmetic: 8 × (1000 / 19) ≈ 421.

BoxLang 1.15.0 Released: Blazing Fast Strings, Runtime Portability, and much more

Tue, 14 Jul 2026 17:57:10 +0000

BoxLang 1.15.0 is a high-impact release with two big headlines and a long tail of hardening. The first headline is a massive performance upgrade to string handling : a new first-class BoxStringBuilder type, compile-time literal folding, smarter &= semantics, and a runtime concat strategy that automatically switches to builder-backed accumulation once your expression gets big enough. Your existing string-heavy code just got faster. No rewrites required.

The second headline is architectural. Every class loader in the BoxLang runtime and module system has been fully abstracted behind a pluggable IClassLoaderFactory interface. That single seam is what unlocks the Android runtime and Ahead-of-Time (AOT) compiled runtimes such as GraalVM Native Image that we have on the roadmap. The default behavior is unchanged, but the ceiling just got a lot higher.

Endive 1.0 Is Here: Wasm on the JVM Ships Under the Bytecode Alliance

Mon, 29 Jun 2026 00:11:00 +0000

A few weeks ago, we wrote about a new generation of Java libraries powered by WebAssembly. SQLite, QuickJS, Protocol Buffers, the Ruby Prism parser, all compiled to Wasm and shipped as regular JARs. No JNI, no platform-specific binaries. Wasm as an implementation detail.

Today, the runtime that makes it all work has its first official release under the Bytecode Alliance. Endive 1.0 is available on Maven Central.

What Shipped

Endive continues the work started as Chicory, the pure-Java WebAssembly runtime that has been powering this ecosystem since 2023. Same API, same community, same codebase. The move to the Bytecode Alliance is organizational, not technical. For details on the fork and governance, see the announcement article.

BoxLang 1.14.0: BoxSet is Here, BoxLang's New First-Class Set Type

Wed, 17 Jun 2026 10:36:28 +0000

BoxLang 1.14.0 ships with a new dynamic first-class Set type baked directly into the language. Not a wrapper you reach for manually, not a createObject( "java", "java.util.HashSet" ) incantation you paste from a Stack Overflow answer years ago. A real BoxSet with literal syntax, operator overloads, a full functional pipeline, change listeners, JSON serialization, and deep Java interop.

If you have ever deduplicated an array with a loop, compared two collections element by element, or modeled a permission system on top of a struct – Sets are the tool you were missing. Let’s dig in.

BoxLang 1.14.0: Introducing Inner Classes

Thu, 11 Jun 2026 10:29:32 +0000

BoxLang has always embraced a simple truth: the way you organize code shapes the way you think about problems. For a long time, if you needed a helper class, you needed a file. One class, one .bx file, no exceptions. This also stemmed from the CFML days. That’s clean and predictable, but it creates real friction when a class is tightly coupled to exactly one caller and has no business existing anywhere else.

Your TLS Stack Is Lying to You About Zero-Copy

Wed, 10 Jun 2026 12:00:28 +0000

The “No Waste Compute” Constraint

When I started designing the Exeris Kernel, I set one non-negotiable rule very early: no waste compute. That rule sounds like a performance slogan until it starts killing otherwise normal design decisions.

I had already banned ThreadLocal, moved context propagation to Scoped Values, and pushed more of the runtime into explicit off-heap ownership. The idea was simple: if the hot path is supposed to stay outside GC pressure, then memory shape and lifetime cannot be treated as incidental details.

Foojay Podcast #95: Is Your Java App Actually Secure, Or Does It Just Look That Way?

Mon, 11 May 2026 09:57:00 +0000

Is your Java application actually secure, or does it just look that way? In this episode of the Foojay Podcast, Frank is joined by Steve Poole and David Welch, both from HeroDevs, to dig deep into the state of Java security in 2025 and beyond.

Steve introduces the concept of zombie dependencies: end-of-life libraries that appear safely dormant but are quietly accumulating vulnerabilities waiting to bite you. David, a co-chair of the CVE Automation Working Group, explains what a CVE actually is, how the identification and disclosure process works in practice, and why AI tools like Mythos are dramatically accelerating the pace at which new vulnerabilities are found — on both sides of the wall.

Using the Azul Zulu Docker Official Images: From Simple Pull to Lean Container

Fri, 08 May 2026 09:05:22 +0000

Previously in this series:

Azul Zulu is now a Docker Official Image, so getting a trusted, secure Java base image is now just a FROM azul-zulu line in your Dockerfile. But pulling the right image is just the beginning. This post shows you how to use these images in practice, and how a few extra steps can seriously cut the size of what you ship.

UCanAccess: The Modern Pure-Java Bridge to Microsoft Access

Wed, 06 May 2026 08:44:00 +0000

Microsoft Access databases are everywhere. Decades of .mdb and .accdb files silently power spreadsheets, small business applications, and legacy data stores across organizations of all sizes. Yet for Java developers, connecting to these files has historically meant wrestling with native Windows libraries, ODBC bridges, and platform-specific hacks.

UCanAccess puts an end to that. It is an open-source, pure-Java JDBC driver that lets you read and write Microsoft Access databases (.mdb and .accdb) just like any other SQL database — no native drivers, no Windows dependency, no friction.

Foojay Podcast #94: More Than a Blog: How Foojay Connects, Sustains, and Evolves the Java Community

Mon, 04 May 2026 06:26:00 +0000

Foojay.io, the website for the Friends Of OpenJDK, is turning six years old. To celebrate, Frank Delporte headed to JCON in Cologne, Germany, and sat down with twelve members of the Java community to talk about what Foojay means to them, what they learn from each other, and how the community is evolving.

This episode covers a lot of ground. Sharat Chandar reflects on 25 years in the Java community and why the people are what keep the language alive. Markus Westergren and Iryna Dohndorf both focus on a theme that comes up again and again: developer sustainability. Not just green software, but how you stay healthy, grounded, and relevant when AI is changing everything around you. Markus and his wife researched how developers are reacting to AI, from ignoring it completely to transforming everything they do. Iryna talks about building resilience and robustness as skills, not afterthoughts.

The Road to Docker Official Images for Java: The Azul Zulu Story

Fri, 24 Apr 2026 08:57:12 +0000

Previously in this series:

Trusted Java Containers: Azul Zulu OpenJDK Joins Docker’s Official Images

After more than two years of collaboration, reviews, and back-and-forth with the Docker team, Azul Zulu Builds of OpenJDK have officially joined Docker’s Official Images program. This is not just a badge of honor. It changes how Java developers can pull and trust their container base images.

The formal announcement is on the Azul blog. In this post, I’ll walk you through what happened, why it matters, and how to start using these images today.

How to Use Java as a Scripting Language

Mon, 23 Mar 2026 10:00:19 +0000

The Scripting Dilemma

If you’re like me, as a Java developer, you struggle to remember bash or python syntax for quick scripts.

You end up “vibe coding” it, then struggle again when you need to adapt it. If only you could write it in Java!

You might say “Java is not for scripting” and “I don’t want maven or Gradle”.Modern Java has quietly eliminated the traditional barriers that made it unsuitable for scripting.With instant execution, shebang support, and zero-setup automation, Java has evolved into a lean scripting language. Write precise, maintainable code without the “vibe coding” that comes with unfamiliar languages.

Native Memory in Java: Arenas, Malloc, and Pools

Fri, 20 Mar 2026 10:20:04 +0000

What is the Memory API

The Foreign Function & Memory (FFM) API is Java’s new way of interacting with native code and memory. It is mostly useful when storing data off-heap or passing arguments to a native method. Handling this native memory comes down to balancing how much control you need against the risk of memory leaks. You can rely on the provided Arenas to bind memory to safe scopes, or you do it yourself using malloc and free for absolute control, or implement custom pools and slices to optimize allocations for your use case.

Foojay Podcast #92: Java 26 Is Here: What's New, What's Gone, and Why It Matters in 2026

Mon, 16 Mar 2026 06:58:00 +0000

Welcome to another episode of the Foojay Podcast! In this episode, we’re talking about Java 26, released on March 17 in the year 26. Again, right on schedule with Java’s six-month release cadence.

Now, Java 26 is not a Long Term Support (LTS) release; that was Java 25. But don’t let that fool you into thinking there’s nothing interesting here. This release brings ten JDK Enhancement Proposals (JEPs). They cover everything from performance improvements to long-overdue cleanups. Of those ten JEPS, five are new features, and we also get five preview/incubator features.

I Benchmarked Java on Single-Board Computers: Orange Pi 5 Ultra and Raspberry Pi 5 Lead the Pack

Wed, 04 Mar 2026 06:52:00 +0000

In my “Java on Single Board Computers” series, I already published several posts and videos in which I unpack the board, connect it for the first time, and try to install and run some simple Java code. In this post, I want to share some benchmarks of Java on these boards to get a better idea of the performance we can expect from Java on these platforms.

Already published in this series:

Gotta Code 'Em All: How Java Evolved Beyond Verbosity – Celebrating 30 Years of Pokémon

Fri, 27 Feb 2026 09:57:35 +0000

Happy 30th Anniversary to Pokémon! 🎉

February 27, 2026 marks exactly 30 years since the original Pokémon Red and Green launched in Japan on February 27, 1996. From catching your first Pokémon in Pallet Town to becoming Champion in the Indigo League, the franchise has spent three decades teaching millions of players about strategy, friendship, exploration, and constant improvement, evolving creatures, teams, and even entire generations of games.

Pokémon is literally all about evolution and that same spirit of evolution perfectly matches what’s happening in Java right now.

JVM timing options

Mon, 23 Feb 2026 16:45:39 +0000

For as long as I have been coding in Java, we have had requirements to measure the execution time of blocks of code. While the current good practice is to use OpenTelemetry’s traces, not every company has reached this stage yet. Plus, some of the alternatives are OpenTelemetry-compatible. Let’s see them in order.

The basic option

The basic option is what we have been doing for ages, and what the other options rely on anyway. It’s based on the following API: System.currentTimeMillis().

A Visual Diff of Java’s Evolution: Inside java.evolved

Fri, 20 Feb 2026 17:48:21 +0000

A community project called java.evolved was recently launched to document how common Java coding patterns have changed across releases. Instead of explaining features in isolation, the site presents “before and after” examples: traditional idioms next to modern alternatives.

The approach targets a practical problem. Most developers work in mixed-era codebases where Java 6, 8, and 17 styles coexist. Rather than memorizing new language features, the site shows what existing code would look like if written today.