Maven on foojay.io - Friends Of OpenJDK

This Dependency Update Looked Exactly Like an Account Takeover

Fri, 03 Jul 2026 08:31:27 +0000

I pointed a scanner I have been building at an old Spring project, and it flagged javax.activation. The bump was 1.1-rev-1 to 1.1.1. Prior releases carried a GPG signature. This one did not.

If you have read the post-mortems of real supply-chain attacks, that pattern should make you sit up. A package that has signed its releases for years suddenly ships one unsigned. The boring explanation is a build pipeline change. The other explanation is that a different person is publishing now, and the signing key stayed behind with the old one. When ua-parser-js was hijacked in 2021, the malicious versions came from a compromised account. When event-stream went bad in 2018, it was a new maintainer nobody had vetted. The artifact looks fine. The metadata around it is what changed.

You’re invited to IntelliJ IDEA Conf 2026!

Mon, 29 Jun 2026 18:35:08 +0000

We are excited to invite you to IntelliJ IDEA Conf 2026, a free virtual event on September 8-9, 2026.

IntelliJ IDEA Conf is a celebration of the developer community, bringing together professionals who strive for excellence in software development. Join us for this free, live online conference and learn from industry leaders and experts on September 8-9, 2026.

You’ll be able to learn about a broad range of topics relevant to modern Java and Kotlin development, including language evolution, enterprise Java, Spring-based applications, build tooling, containerized workflows, JVM performance, and data access technologies. For more details, see the agenda below.

Jurassic JDK: Migrate or Extinct

Fri, 26 Jun 2026 07:28:00 +0000

65 million years ago, dinosaurs didn’t adapt. They’re gone. Your JDK 7 app is giving the same energy. 🫠

I spent a year and a half migrating more than 15 projects in production. Full time. Real teams, real deadlines, real 2am breakage. This is everything I wish someone had written before I started.

Why Are We Still Here? 👀

Walk into any company with a codebase older than 5 years and you’ll hear the same thing:

Enterprise Java quality gates in the age of AI

Fri, 29 May 2026 07:00:00 +0000

People and AI can write code together, but enterprise repositories still need deterministic quality gates to protect code quality.

Enterprise quality is a scaling problem

Enterprise Java development is not only about writing correct code. It is about keeping a large, long-lived codebase understandable, reviewable and safe to change while many people and many tools touch it over time.

Explore Spring AI SDK – Amazon Bedrock AgentCore – Part 2

Mon, 27 Apr 2026 09:09:00 +0000

If you’re joining us from Part 1 or need a quick refresher on the architecture, listen to this brief overview of how Spring AI and Amazon Bedrock work together. Generated using Notebook LLM for my previous article

In this article, we explore one of the AgentCore capabilities i.e., memory Source: Amazon

To begin, enable AgentCore memory for the agent you built earlier.

Step 1: Add the Ai model and AgentCore memory dependencies

<dependency>
 <groupId>org.springframework.ai</groupId>
 <artifactId>spring-ai-model</artifactId>
</dependency>
<dependency>
 <groupId>org.springaicommunity</groupId>
 <artifactId>spring-ai-agentcore-memory</artifactId>
</dependency>

Step 2: Create Short/Long Term in AWS Management Console

Navigate to Amazon Bedrock AgentCore > Memory to create short/long-term memories. AgentCore Memory

Optimizing Java for the Cloud-Native Era with Quarkus

Tue, 06 Jan 2026 21:09:00 +0000

This article explores how Quarkus can help organizations reduce costs, streamline development, and modernize their Java applications for today’s cloud-native environments. It outlines the real-world benefits of adopting Quarkus and highlights how its core features address the performance and scalability challenges commonly associated with traditional Java frameworks.

Quarkus is already being adopted across industries. One example is Orange, a global telecom provider that selected Quarkus to support its 5G API initiative, and benefited from fast startup times, a lightweight footprint, and seamless integration with Kubernetes.

Getting Started with TornadoVM 2.0 for Accelerating Java Applications

Mon, 22 Dec 2025 10:00:00 +0000

Starting with TornadoVM 2.0 , installing and using TornadoVM is easier than ever. The project now provides prebuilt SDKs for multiple operating systems, architectures, and accelerator backends, and is also available via Maven Central for seamless integration with existing Java codebases.

This guide walks you through:

Installing the TornadoVM SDK
Verifying your setup
Integrating TornadoVM into Java projects using Maven

Prerequisites

Before installing TornadoVM, ensure that your system has the following:

How to Release a Java Module to Maven Central with JReleaser and GitHub Actions (2025 Guide)

Fri, 12 Dec 2025 07:42:00 +0000

This article is a tutorial that guides you through the process of releasing a Java module with JReleaser to Maven Central with Github Actions. It is a 2025 update of the foojay.io/today/how-to-release-a-java-module-with-jreleaser-to-maven-central-with-github-actions article.

JReleaser is a tool that streamlines the release process for Java projects, allowing developers to quickly and efficiently publish their modules to Maven Central.

This article will use the SemVer Check project as an example project that uses Maven as a build tool.

Foojay Podcast #81: Maven 4 - The Future of Java Build Automation

Mon, 03 Nov 2025 06:03:12 +0000

Maven 4 is approaching its release, bringing many improvements to the build tool powering millions of Java projects.

In this Foojay Podcast episode, we talk about Apache Maven 4, a significant milestone that has been years in the making. Maven has been the backbone of Java dependency management and build automation since the early 2000s; however, the road to version 4 has been a long and deliberate one. With significant performance improvements, a modernized API for plugin developers, and changes that affect how we think about project structure, Maven 4 represents both an evolution and a revolution. What does this mean for the millions of developers who depend on Maven daily? How should teams prepare for the transition? And what’s the story behind the Maven Central Repository changes that have been making headlines? To answer these questions and more, we’re joined by a few of the many contributors who are actually building Maven 4 and stewarding its ecosystem.

Payara Server Maven Plugin + AI Agent

Tue, 30 Sep 2025 08:43:20 +0000

Managing Payara Server Just Got Smarter

Imagine managing your Jakarta EE applications not just with Maven goals, but by asking natural questions.

With the experimental AI Agent built into the Payara Server Community’s Maven Plugin, you can now query server internals and perform admin tasks using plain English — directly from the same terminal where you build and deploy your applications.

Thanks to this integration, developers can inspect, query and even execute server commands using natural language. It’s a powerful and intuitive way to interact with Payara Server — no need to remember long command syntax or dig through documentation.

How to Kickstart Your Jakarta EE 11 Projects with Payara Starter

Tue, 23 Sep 2025 10:26:53 +0000

Jakarta EE 11 is here, bringing powerful new capabilities for enterprise Java developers. But getting started quickly can be a challenge - that’s where the latest Payara Starter comes in. With full Jakarta EE 11 support, an updated ERD-based code generator, and a new Jakarta Faces project generator, it gives you everything you need to launch your next application with ease.

With Jakarta EE 11 now officially released, you are likely eager to explore its new capabilities but setting up your first application may take longer than you want. That’s where the latest version of Payara Starter steps in, giving you a fast, hassle-free way to get a fully functional Jakarta EE 11 project up and running. Read more to learn how!

Preparing for Spring Boot 4 and Spring Framework 7: What’s New?

Mon, 11 Aug 2025 14:42:40 +0000

I’m a passionate Spring Framework and Spring Boot enthusiast, and I always look forward to exploring and experimenting with the latest features and improvements they introduce. With Spring Boot 4 and Spring Boot Framework 7 right around the corner, now’s the perfect time to dive into the key enhancements that will shape the future of modern Java and enterprise application development.

In this blog post, we will discuss some key features enhanced as part of Spring Framework 7 and Spring Boot 4.

Improving Maven's dependency:analyze... or not

Mon, 28 Apr 2025 08:28:32 +0000

Recently, my good friend Richard Fichtner advised using the mvn dependency:analyze command to get rid of declared but unused dependencies:

There is another use case for

mvn dependency:analyze

It can show you the dependencies you use in your code but have not declared in your pom.xml. This works because you have a transitive dependency on your classpath. Either don’t use the dependency or declare it.

— Richard Fichtner 💻☕ @richard.fichtner.dev
December 10, 2024 at 2:00 PM

Spring Boot: Java Template Engine (JTE)

Wed, 13 Nov 2024 09:03:00 +0000

Hello to all Java and Spring enthusiasts. I am the Java Template Engine, a fresh newcomer to the Spring Initializer Ecosystem.

I have gained popularity as a template engine for developing user interface applications that use Java syntax within Spring Boot applications, alongside other engines such as Freemarker, Thymeleaf, Mustache, and Velocity. Many developers widely use Spring Boot, a framework that simplifies Java application development, and incorporating a template engine like mine streamlines the process of creating dynamic and responsive user interfaces.

Get recognized for your cloud-native Java development skills

Thu, 29 Aug 2024 16:08:34 +0000

In a world where in-demand skills are critical for job success, security, and progression, it’s vital that we, as developers, ensure we are showcasing our skills to the wider world. This can include qualifications, courses, and badges, all of which help us to advertise our skills and highlight our professional experiences and expertise.

So, to help make this easier (and free!) for Java developers, the Open Liberty team created the first-ever Liberty badge: Liberty Developer Essentials!

Foojay Podcast #50: JCON Report, Part 2 - Maven, Software Security, Code Quality

Mon, 27 May 2024 08:07:54 +0000

This is part 2 of the interviews we recorded at the JCON conference earlier this month in Germany. In this episode, you get two main topics: Maven and Code Quality.

In the first part, you’ll hear Karl Heinz Marbaise and Steve Poole discuss the Maven project, the repository, Sonaytype, and the security impact of dependencies.

But next to security, we developers are also responsible for creating readable and maintainable code. Miro Wengner, Marit van Dijk, and Hinse ter Schuur dive into this topic, in the second part!

IntelliJ IDEA and Open Liberty - Effective Java app development

Fri, 12 Apr 2024 13:36:25 +0000

See how you can use Liberty Tools for IntelliJ IDEA to enable rapid, easy, and efficient development of cloud-native Java applications with Open Liberty and WebSphere Liberty

When it comes to integrated development environments, within the Java community, IntelliJ IDEA is the most popular IDE amongst professional developers. It is the preferred IDE of choice by two-fifths of developers, making up the biggest majority of IDE users in this community, according to JRebel’s 2023 Java Developer Productivity Report.

Migrate to Spring Boot 3.2 with OpenRewrite

Tue, 06 Feb 2024 08:17:07 +0000

As a developer, we frequently face the challenges of migrating to newer versions of frameworks and refactoring code. However, we can effortlessly achieve these tasks with the assistance of OpenRewrite. OpenRewrite provides a stack of recipes specifically designed for migration purposes. By utilizing the appropriate recipes and integrating with the rewrite plugin, we can effectively migrate our code.

Two months ago, the Spring Boot 3.2 version released, bringing numerous changes to the framework. If you are involved in multiple projects and require migrating to the latest version, developers may find manually updating all the code repositories with the necessary upgrade changes a challenging task.

(Semantic) Versioning your Java libraries

Wed, 03 Jan 2024 15:10:35 +0000

There are a lot of ways to version your library but the semantic versioning scheme is the most used and for a good reason, by looking at the version change you can already defer if you can upgrade the dependency without any problems or if you might have to do some refactoring. Semantic versioning proposes a simple set of rules and requirements that dictate how version numbers are assigned and incremented.

C2 Might Be Slowing Down Your Builds

Thu, 28 Sep 2023 09:55:13 +0000

At the JavaForumNord two weeks ago, I had a friendly chat with Karl Heinz Marbaise (Chairman of the Apache Maven Project), where he mentioned that he wanted to start profiling Maven. This sounded interesting, so I started looking into the performance and bottlenecks of Maven. I began by using the Maven build of maven itself as a starting point (excluding the tests). The following is my first observation related to Maven builds in CIs.

My Final Take on Gradle (vs. Maven)

Tue, 15 Aug 2023 08:37:24 +0000

I tweet technical content that I consider interesting, but the funny tweets are the ones that get the most engagement.

I attended the JavaLand conference in March, stumbled upon the Gradle booth, and found this gem:

Of course, at some point, a fanboy hijacked the thread and claimed the so-called superiority of Gradle. In this post, I’d like to shed some light on my stance, so I can direct people to it instead of debunking the same “reasoning” repeatedly.

Build Rot: The Hidden Technical Debt in Maven and Gradle Builds

Fri, 21 Jul 2023 08:14:01 +0000

Discover ‘Build Rot’, the hidden technical debt in Maven and Gradle builds. This article explores the impact of Build Rot on build speed and test times, offering strategies for enhanced observability and Developer Productivity Engineering to optimize build processes.

Technical debt is a constant companion in the complex world of software development. It’s the price we pay for quick fixes and postponed refactoring—the “we’ll do it right next time” mentality.

Foojay Podcast #26: The Future of Source Control and CI/CD

Mon, 26 Jun 2023 08:35:21 +0000

As developers, we like to automate the boring parts of our job. This automation includes the source control system, build pipelines, and code analysis tools.

In recent decades, we have seen evolutions from CVS to Subversion to Git. Is this the endpoint? Did we find the holy grail in version control? Or what evolutions are waiting for us?

Let’s find out together with these fantastic guests…

This is the final episode of season 2 of the Foojay Podcast. See you in September for the start of our new season with more JUGs, the launch of Java 21, and much more!

Rolling Binary Trees: A Guide to Common Design Patterns in Java

Wed, 24 May 2023 12:55:14 +0000

Introduction

Binary trees are fundamental data structures, ubiquitous in computer science and software engineering. We use them to represent hierarchical data and implement more complex data structures, such as search trees, syntax trees, cryptographic hash trees, space partitioning trees, heaps, and so on. Common binary tree operations include insertion, deletion, traversal, and rotation.

A relatively uncommon and unexplored operation is roll , which modifies the structure of a binary tree in such a way that, when visualized, the newly obtained structure appears to be rolled at a 90-degree angle, either clockwise or counterclockwise. This gives us two variants of the roll operation — clockwise roll (CR) and counterclockwise roll (CCR).

Analyzing dependencies in IntelliJ IDEA

Thu, 11 May 2023 09:33:40 +0000

If you’re working on a real world project, you’re probably using external dependencies.

You might need to analyze which dependencies your application uses.

For example, you may want to find out how a particular version of a dependency ended up in your application.

Let’s take a look at how IntelliJ IDEA can help you to analyze dependencies.

Using the Dependency Analyzer

We can view our dependencies in the Maven or Gradle tool window.

Foojay Podcast #19: Working Free For Fun Brings Fame & Fortune

Mon, 17 Apr 2023 12:35:51 +0000

Many developers spend a lot of their time on side projects. It’s an opportunity to learn new techniques and get involved in communities.

But sometimes it can also lead to a new job.

Or even starting a business based on such a project.

Today we are talking to people who achieved such a transition and became famous and rich, or at least some of each…

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

Predicting Secure Java Projects on Maven Central

Thu, 23 Mar 2023 14:10:02 +0000

If you’ve searched for Maven Central components in the last six months, you may have noticed some pretty big changes to the website, including a UI facelift and some new component analysis tools like BOM Doctor and the Sonatype Safety Rating.

It’s no coincidence that many of these changes are security related. Maven Central, along with public code repositories, are the first line of defense when it comes to supply chain security.

How to Find & Fix Vulnerabilities with IntelliJ IDEA Ultimate

Mon, 13 Feb 2023 09:09:39 +0000

In this article, we’re going to take a look at the Package Checker plugin, that’s bundled with IntelliJ IDEA Ultimate.

We’ll have a look at how to view known vulnerabilities in your Maven or Gradle projects, how to get more information about the known vulnerabilities in a specific dependency and how to remediate these vulnerabilities inside IntelliJ IDEA Ultimate if a new version with a fix is available.

Release with JReleaser to Maven Central with GitHub Actions

Wed, 18 Jan 2023 08:55:48 +0000

This guide is outdated since 2024. There is a new version here: https://foojay.io/today/how-to-publish-a-java-maven-project-to-maven-central-using-jreleaser-and-github-actions-2025-guide/

This article is a tutorial that guides you through the process of releasing a Java module with JReleaser to Maven Central with Github Actions.

JReleaser is a tool that streamlines the release process for Java projects, allowing developers to quickly and efficiently publish their modules to Maven Central.

If you just want to publish your Maven project by hand, then you can follow How to Publish a Java Maven Project to the Maven Central Repository by @Tobias Briones.

Managing Dependencies in IntelliJ IDEA

Tue, 10 Jan 2023 15:13:39 +0000

In this tutorial, following on from viewing dependencies, we’re going to take a look at managing dependencies in IntelliJ IDEA.

We’ll look at different ways to add dependencies to your project, and how to add, upgrade and remove dependencies using Package Search.

Add dependencies

There are several ways to add new dependencies to your project.

From the build file using copy-paste

You have probably copied a dependency from Maven Repository (or another website) and pasted into your build file.