Java on foojay.io - Friends Of OpenJDK

How to Secure a Spring Boot Application with OpenID Connect and pac4j

Fri, 23 Oct 2026 00:00:00 +0000

pac4j is an open-source Java security library for authentication and authorization. It supports protocols such as OpenID Connect, OAuth 2.0, SAML and CAS, with integrations for multiple Java web frameworks. I am Jérôme LELEU, the maintainer of pac4j. In this tutorial, we will use its OpenID Connect client with Spring Boot.

You want users to sign in to your Java application with Keycloak, Google, Microsoft Entra ID, Okta, Auth0 or even a CAS server. They already have an account there, so your application should not ask them for another password.

OWASP Java Security Libraries: Please Update!

Fri, 23 Oct 2026 00:00:00 +0000

Hello Foojay!

I’ve been working hard on bringing two Java security libraries up to date: OWASP Java Encoder and OWASP Java HTML Sanitizer. These libraries are still used in a lot of applications and security products around the world. Both have fresh releases, and I’d love to get more Java developers looking at them again.

My request is pretty simple: please update if you use these! And if they matter to your application, I’d love your feedback.

Android on iOS, Web & Desktop Efficiently and for Free

Thu, 22 Oct 2026 00:00:00 +0000

We are not the first to bring Android to iOS. Earlier projects brought Android’s runtime along with the application. Dalvik was built for Android, including a just-in-time compiler (JIT) that ordinary iOS apps are not permitted to use. Disabling it removes an important source of Dalvik’s performance. Dalvik was designed around interpretation and JIT compilation, not ahead-of-time compilation (AOT), so taking away the JIT leaves an interpreter rather than an optimized native app.

Exact Prices in Java: Decimal Strings and BigDecimal Traps

Thu, 22 Oct 2026 00:00:00 +0000

Prices look like the simplest data there is: a number with a few decimals. Then a crypto price arrives with fifteen decimal places, a token trades at 0.000012341873905, and the numbers on screen stop adding up. This article walks through what goes wrong between the JSON and the screen, and how to keep every digit with BigDecimal and Jackson. For the wider trade-offs between the number types, see double, BigDecimal, or Fixed-Point? on foojay; this article follows one price from the JSON to the screen.

BoxLang 1.18.0 Released: Every Cloud, Every Node, Every Agent

Wed, 21 Oct 2026 00:00:00 +0000

Azure joins the serverless family. Scheduled tasks become cluster-safe. And the whole platform gets documentation and skills built for developers and AI agents working side by side.

If you run a technology organization, you are being asked to do three things at once: ship faster, keep the estate you already have running, and make AI part of how your teams work. Most stacks make you choose. BoxLang 1.18 is another step toward not having to.

BxPlaywright 1.0: Real Browsers, Fluent BoxLang, Built for AI Agents

Wed, 21 Oct 2026 00:00:00 +0000

Ortus Solutions today announces the general availability of bx-playwright 1.0, fluent browser automation and testing for BoxLang, powered by Microsoft Playwright. It ships alongside TestBox 7.2 and ColdBox 8.3, which bring real-browser testing straight into your specs. Drive Chromium, Firefox and WebKit, test full user journeys, render PDFs and images, and give your AI agents a real browser to verify the BoxLang applications they build.

playwright().browse( ( page ) => {
	page.visit( "/login" )
		.fill( "Email", "luis@ortus.com" )
		.fill( "Password", "secret" )
		.click( "Sign in" )
		.assertPathIs( "/dashboard" )
		.assertSee( "Welcome back" )
		.screenshot( "dashboard.png" )
} )

That’s a full login check. It reads like the steps you’d write on a sticky note, and every line runs in a real browser. 🚀

Java Stream Gatherers: From Built-in Patterns to Custom Pipeline Mechanics

Wed, 21 Oct 2026 00:00:00 +0000

Java Stream Gatherers: From Built-in Patterns to Custom Pipeline Mechanics

1. Introduction & Context
2. Getting Started: Built-In Gatherers in Action
- 2.1 Understanding Stream Cardinality
- 2.2 The Five Ready-to-Use Gatherers
3. Leveling Up: From Using Gatherers to Authoring Your Own
- 3.1 When Should You Write a Custom Gatherer?
- 3.2 Pipeline Composition with andThen()
4. Under the Hood: Architecture & Anatomy of Custom Gatherers
5. Production-Ready Gatherers: Parallelism, State, and Pitfalls
6. Conclusion
References

Upgrading from Java 21 to 25: What Actually Breaks

Tue, 20 Oct 2026 00:00:00 +0000

Most “what’s new in Java 25” articles are about what you gain: Scoped Values, flexible constructor bodies, compact source files, Stream Gatherers. This one is about the other side of an LTS-to-LTS upgrade, the things that stop working.

Four years of releases sit between Java 21 and Java 25, and some of what was deprecated in 21 has been removed by 25. Some of it fails loudly, at startup. Some of it fails silently, which is worse: the build is green, the app starts, and the bug shows up a week later.

Foojay Podcast #103: Killing Reflection at Build Time with Dmitry Moskalyuk and Shai Almog

Mon, 19 Oct 2026 00:00:00 +0000

Runtime reflection is one of those quiet taxes on the JVM: it is flexible, it is everywhere, and it is easy to stop noticing it until you go looking for where your CPU is actually going. In this episode, two teams from completely different corners of the ecosystem explain how they went looking and ended up at the same answer: push the work to build time.

Dmitry Moskalyuk is a new author on Foojay. His article “Reflection-Free Serialization on the JVM: Four Formats In, Avro Out” describes a model layer that ingests JSON, XML, YAML and TOML and converts everything to Avro, and the choice between Jackson and kotlinx.serialization that came down to where the reflection cost hides, and where it does not. Shai Almog has been writing on Foojay since 2021 and works on a build-time code generation pipeline for Codename One, with the goal of “no reflection, no service loader, no Class.forName”.

A Smaller, Faster Java Server with a Spring-Style API

Fri, 16 Oct 2026 00:00:00 +0000

What do you pay for Spring and Java’s dynamic architecture? Can you deliver the same API without the same runtime cost?

For a small service, you might want dependency injection, transactions and scheduled jobs without a long startup or a large deployment. That is the case our native Java backend is trying to make. Write a controller and a service, compile their wiring into the application, then deploy a native executable.

Apple Shouldn't Dictate Your App's Redesign Schedule

Fri, 16 Oct 2026 00:00:00 +0000

Apple’s design team doesn’t know what’s on your backlog. A new iOS appearance might be exactly what you want for your next release. It might also arrive halfway through a customer rollout, when changing the navigation is the last thing you need.

We want to support the new SDK without making that decision for you. This week, you can select Xcode 27 on our build servers with the returning ios.xcode_version hint. Local builds and CI also support Xcode 27, and our iOS 27 theme gets more detailed Liquid Glass effects. You choose when to adopt that appearance. Codename One renders most controls itself, so the theme ships with your app. Updating the SDK can leave that theme and your application CSS in place.

Build Your First SaaS with MongoDB Ephemeral Clusters

Fri, 16 Oct 2026 00:00:00 +0000

It’s a new world. A prototype that once meant hours or days of setup can now be up and running in minutes. With one API call, an AI agent can create a MongoDB Atlas cluster from your IDE, so you can start building without stopping to navigate account setup, cloud choices, regions, or cluster configuration.

In this tutorial, you will use an Atlas Ephemeral Cluster to build a polished job-application tracker: a small SaaS where a user manages applications on a Kanban board. The application is deliberately simple. The point is the workflow: give an agent a real database immediately, validate an idea quickly, and claim the cluster only when the prototype is worth keeping.

Lightweight Spring Boot Monitoring Without Prometheus and Grafana

Thu, 15 Oct 2026 00:00:00 +0000

Running one Spring Boot application or a handful of them on a VPS still calls for basic operational visibility. You need to know whether an application is reachable, whether errors are rising, and whether it restarted. You may not need a complete monitoring platform to answer those questions.

Spring Boot Actuator already exposes much of that information through its health endpoint and Micrometer metrics. StatLite turns it into a focused dashboard for health, requests, errors, latency, memory, uptime, and restarts. It runs as one Go binary and stores its history in SQLite.

One Embedding per Job, or Two? Measuring Semantic Search in a Spring Boot Job Portal

Wed, 14 Oct 2026 00:00:00 +0000

This job portal started as a practice project. I built it after college, mostly so I’d have something to put on my resume. Recently I picked it up again. I was job hunting myself, looking for a switch, and it struck me that I should develop it properly, and maybe even launch it someday.

The first thing that bothered me was search. The results just weren’t good, so I started reading about how to make them better.

What I Learned Building an AI Code Reviewer with Java and Spring Boot

Wed, 14 Oct 2026 00:00:00 +0000

AI-assisted coding has changed how quickly developers can write software.

But that creates another question:

How do you review all that generated code effectively?

That question led me to build CodeGuard AI, a self-hosted AI code-review application for GitHub Pull Requests using Java and Spring Boot.

At first, the architecture seemed simple:

GitHub Pull Request
 ↓
 LLM
 ↓
 Review

In practice, that wasn’t enough. The interesting engineering work was everything around the model: collecting useful Pull Request context, defining review instructions, structuring the model response, assessing findings, and integrating the result back into the GitHub workflow. This article explains what I learned while building that workflow.

Introduction to Error Prone: How to Catch Bugs at Compile Time

Tue, 13 Oct 2026 00:00:00 +0000

The Java compiler’s job is to check whether code follows the rules of the language. Trying to remove an element from a collection that can never contain it, or using the wrong letter in a date pattern, does not break those rules, so nothing stops the code from compiling. In short, any code that follows the rules compiles, even when it does not do what its author intended.

What is Error Prone?

Error Prone is an open source static analysis tool that Google built to fill this gap. Unlike most static analysis tools, it does not run as a separate step; it plugs into javac as a plugin. Using the information the compiler produces while analyzing the code, it looks for patterns that follow the rules of the language but are most likely wrong, and reports them as compiler warnings or errors.

Your agents don't need an LLM to negotiate

Mon, 12 Oct 2026 00:00:00 +0000

In agents that negotiate, the negotiating usually ends up inside a language model. You describe the situation in a prompt, the model answers, and you parse what comes back. It works, and it costs a network round trip and a line on a bill for every decision.

For the narrow case of handing work to whoever should do it, there’s a protocol that predates all of this. It’s called Contract Net, and it’s small enough to read in an afternoon. Agenor ships it. The example below has a manager hand a job to one of three workers in a single JVM, and its imports contain nothing from any model provider.

Introducing cbGenesis: The AI-Native ColdBox Starter for BoxLang

Fri, 09 Oct 2026 00:00:00 +0000

Ortus Solutions today announces the general availability of cbGenesis 1.0, a production-ready ColdBox HMVC starter template for BoxLang, and the first one designed from day one to be built with an AI coding agent, not just by one.

For twenty years, ColdBox has been one of the most battle-tested HMVC frameworks in the CFML and BoxLang world. cbGenesis takes that foundation and ships the part every team rebuilds by hand: authentication, permissions, security hardening, an admin panel, tests, and the guidance an AI agent needs to extend all of it correctly.

We Didn't Want to Build Another Java Server

Fri, 09 Oct 2026 00:00:00 +0000

Why Build Another Java Server?

The last thing we wanted to build was another Java server framework. We have Spring, Micronaut, Quarkus, and enough ways to answer an HTTP request to fill a conference schedule.

try.boxlang.io Now Runs Every BoxLang Version, With or Without CFML

Thu, 08 Oct 2026 00:00:00 +0000

The BoxLang playground now lets you choose among released BoxLang versions and switch CFML compatibility on or off without installing a runtime or setting up containers. Choose a version, enter a snippet, and run it in the browser.

Behind the editor is a serverless implementation on AWS Lambda. Each combination of BoxLang version and compatibility mode is built from one repository and deployed as an isolated function. Here’s what changed and how that arrangement works.

Adding RAG to a Jakarta EE 11 App With Only the JDK and Jakarta Specs

Wed, 07 Oct 2026 00:00:00 +0000

The standard story about AI in the enterprise goes something like this. Your app needs AI, so you spin up a Python service. You add a vector database like Pinecone or Weaviate. You pick an orchestration framework. You now have two deployment pipelines, two languages, and two teams. The original Java monolith that handled your business logic just fine becomes one half of a distributed system that exists mostly to connect to the other half.

Green Build, Wrong Task: A Working Agreement for Java Teams Using AI Coding Agents

Wed, 07 Oct 2026 00:00:00 +0000

You open a pull request. ./gradlew check is green, the diff is 400 lines, the description says “added tests as requested”. You scroll and see a dozen unit tests for one service class. What you asked for, in a two-line Jira comment, was end-to-end coverage of the checkout flow.

Nobody lied. The agent filled a gap in the request with the most likely reading and got to work. This is the first of three failure modes our team went through in a webinar on September 28. I am writing it up because the fixes turned out to be boring and mechanical, and they work with whatever agent your team has already installed.

Real-Time Fraud Detection in Java with Kafka Streams and Vector Similarity

Wed, 07 Oct 2026 00:00:00 +0000

This content is based on a talk that my colleague Tim Kelly and I presented at DevNexus 2026 in Atlanta, one of the largest Java conferences in the world.

Imagine you’re at a supermarket or shopping online. You tap your card or click “Buy Now”. In that exact moment, your bank has to make a decision: is this transaction legitimate, or is it fraud? And it has to do that in milliseconds, and get it right. If it blocks a real transaction, it frustrates the customer. If it approves a fraudulent one, it leads to financial loss. So the question is: how do banks actually do this? What’s happening behind the scenes? In this article, we’ll explore a real-world approach to solving this problem using Java, Apache Kafka, Kafka Streams, and vector similarity with MongoDB.

Building a Code Editor Control in JavaFX

Tue, 06 Oct 2026 00:00:00 +0000

JavaFX doesn’t ship with a code-editor control, and TextArea isn’t built to grow into one — no per-character styling, no gutter, no virtualization tuned for thousands of lines. Building a real one means going back to Control + Skin and constructing the editor surface yourself. This post walks through several pieces of a custom editor control.

The core idea: two virtualized lists, not one

The instinctive design is a single ListView<String>, one row per line, with each row containing both the line number and the code. This approach has a drawback: when the user scrolls horizontally, the line numbers disappear.

Run Java in the Browser with TeaVM

Tue, 06 Oct 2026 00:00:00 +0000

There’s something satisfying about editing a line of Java on a web page, clicking Run, and seeing the result appear right there in the browser. I use this approach for the live Java snippets at nablatensor.com/learn and for source code used to bootstrap nablatensor.com/quantlab. In this article, I’ll explain how the pieces fit together and walk you through a React app you can run yourself.

From Java source to a result

TeaVM compiles Java bytecode into JavaScript or WebAssembly for the browser. To let readers edit and compile the examples, I use teavm-javac, which brings a Java compiler into the browser as well. Compilation happens directly in the reader’s browser: the edited source is sent to a Web Worker in the same tab, without sending a compilation request to a server.

Foojay Podcast #102: Why Foojay Walked Away From WordPress for Static Sites

Mon, 05 Oct 2026 00:00:00 +0000

Foojay.io quietly moved off WordPress and onto Hugo, a static site generator. No more CMS login, no database, no admin panel — just Markdown and AsciiDoc files, built and deployed straight from GitHub. In this episode we dig into why that move happened, and into the bigger question behind it: is a traditional CMS still the right way to run a content site in 2026, or has static tooling caught up? Along the way we go through the real security numbers behind WordPress’s plugin ecosystem — more than 10,000 vulnerabilities found in WordPress plugins since 2025 alone — and put very different static site generators head to head: Hugo and Jekyll, the veterans, versus Roq, the Java-and-Quarkus-based newcomer.

Changes Included in Release 26.08 of Azul Zing Builds of OpenJDK

Fri, 02 Oct 2026 00:00:00 +0000

Azul Zing Builds of OpenJDK, the optimized Java runtime within Azul Platform Prime, has reached the release of the 26.08 Stable Release line. This Stable Build represents an August 2026 promotion from Stream to Stable status, consolidating six months of Stream Build work into a single, supported release line. The headline addition is Compilation Streaming, which lets a JVM download pre-compiled code from Azul Optimizer Hub at startup instead of waiting on its own JIT compilation queue.

Announcing 'Skinning JavaFX Applications'

Thu, 01 Oct 2026 00:00:00 +0000

If you’ve ever tried to make a JavaFX application look like Microsoft or JetBrains, you know that CSS is not enough. Skinning JavaFX Applications is my attempt to close that gap — a practical, code-first book built from years of shipping real desktop business applications.

The main purpose of this book is to cover the Control-Skin architecture, so you can create your own custom controls and skins. We’ll cover how to implement custom window chrome, runtime theme switching, Fluent Design materials like Mica and Acrylic, and a full set of micro-interactions.

Lathe: A Java Language Server That Works Straight From Your Maven Build

Thu, 01 Oct 2026 00:00:00 +0000

I have written Java in many editors and IDEs over the years, and they all seem to struggle with the same thing.

For me, the hard part of a Java IDE or language server was never the code intelligence. It was getting the project structure right. The IDE reads your build files and then tries to guess the module structure from them. And over time, Java’s compiler and runtime configuration has become more and more complex: annotation processors, the module system, and more. So you often end up in a familiar place: the code compiles and runs in the build, but not in the IDE. Even the best ones tend to break the project setup after an upgrade.

Durable Execution Is a Property, Not a Product

Wed, 30 Sep 2026 00:00:00 +0000

Three method calls. That is my entire workflow: charge a payment, reserve inventory, send a confirmation email.

Run those three calls on a dedicated workflow engine and here is what happens before your business logic is done: 23 history events are appended, 15 durable state transitions are committed to a database, and 15 gRPC round trips travel between your worker and the orchestration cluster.

That, in one paragraph, is why I want to talk about durable execution. Not because the engines are bad. They are impressive systems built by serious engineers. I want to talk about it because the Java community is being sold a property as if it were a product, and I think most of us already own the property.

Java on foojay.io - Friends Of OpenJDK

How to Secure a Spring Boot Application with OpenID Connect and pac4j

OWASP Java Security Libraries: Please Update!

Android on iOS, Web & Desktop Efficiently and for Free

Exact Prices in Java: Decimal Strings and BigDecimal Traps

BoxLang 1.18.0 Released: Every Cloud, Every Node, Every Agent

BxPlaywright 1.0: Real Browsers, Fluent BoxLang, Built for AI Agents

Java Stream Gatherers: From Built-in Patterns to Custom Pipeline Mechanics

Java Stream Gatherers: From Built-in Patterns to Custom Pipeline Mechanics

Table of Contents

Upgrading from Java 21 to 25: What Actually Breaks

Foojay Podcast #103: Killing Reflection at Build Time with Dmitry Moskalyuk and Shai Almog

A Smaller, Faster Java Server with a Spring-Style API

Apple Shouldn't Dictate Your App's Redesign Schedule

Build Your First SaaS with MongoDB Ephemeral Clusters

Lightweight Spring Boot Monitoring Without Prometheus and Grafana

One Embedding per Job, or Two? Measuring Semantic Search in a Spring Boot Job Portal

What I Learned Building an AI Code Reviewer with Java and Spring Boot

Introduction to Error Prone: How to Catch Bugs at Compile Time

What is Error Prone?

Your agents don't need an LLM to negotiate

Introducing cbGenesis: The AI-Native ColdBox Starter for BoxLang

We Didn't Want to Build Another Java Server

Why Build Another Java Server?

try.boxlang.io Now Runs Every BoxLang Version, With or Without CFML

Adding RAG to a Jakarta EE 11 App With Only the JDK and Jakarta Specs

Green Build, Wrong Task: A Working Agreement for Java Teams Using AI Coding Agents

Real-Time Fraud Detection in Java with Kafka Streams and Vector Similarity

Building a Code Editor Control in JavaFX

The core idea: two virtualized lists, not one

Run Java in the Browser with TeaVM

From Java source to a result

Foojay Podcast #102: Why Foojay Walked Away From WordPress for Static Sites

Changes Included in Release 26.08 of Azul Zing Builds of OpenJDK

Announcing 'Skinning JavaFX Applications'

Lathe: A Java Language Server That Works Straight From Your Maven Build

Durable Execution Is a Property, Not a Product