Spring on foojay.io - Friends Of OpenJDK

How to Secure a Spring Boot Application with OpenID Connect and pac4j

Fri, 23 Oct 2026 00:00:00 +0000

pac4j is an open-source Java security library for authentication and authorization. It supports protocols such as OpenID Connect, OAuth 2.0, SAML and CAS, with integrations for multiple Java web frameworks. I am Jérôme LELEU, the maintainer of pac4j. In this tutorial, we will use its OpenID Connect client with Spring Boot.

You want users to sign in to your Java application with Keycloak, Google, Microsoft Entra ID, Okta, Auth0 or even a CAS server. They already have an account there, so your application should not ask them for another password.

Build Your First SaaS with MongoDB Ephemeral Clusters

Fri, 16 Oct 2026 00:00:00 +0000

It’s a new world. A prototype that once meant hours or days of setup can now be up and running in minutes. With one API call, an AI agent can create a MongoDB Atlas cluster from your IDE, so you can start building without stopping to navigate account setup, cloud choices, regions, or cluster configuration.

In this tutorial, you will use an Atlas Ephemeral Cluster to build a polished job-application tracker: a small SaaS where a user manages applications on a Kanban board. The application is deliberately simple. The point is the workflow: give an agent a real database immediately, validate an idea quickly, and claim the cluster only when the prototype is worth keeping.

Lightweight Spring Boot Monitoring Without Prometheus and Grafana

Thu, 15 Oct 2026 00:00:00 +0000

Running one Spring Boot application or a handful of them on a VPS still calls for basic operational visibility. You need to know whether an application is reachable, whether errors are rising, and whether it restarted. You may not need a complete monitoring platform to answer those questions.

Spring Boot Actuator already exposes much of that information through its health endpoint and Micrometer metrics. StatLite turns it into a focused dashboard for health, requests, errors, latency, memory, uptime, and restarts. It runs as one Go binary and stores its history in SQLite.

One Embedding per Job, or Two? Measuring Semantic Search in a Spring Boot Job Portal

Wed, 14 Oct 2026 00:00:00 +0000

This job portal started as a practice project. I built it after college, mostly so I’d have something to put on my resume. Recently I picked it up again. I was job hunting myself, looking for a switch, and it struck me that I should develop it properly, and maybe even launch it someday.

The first thing that bothered me was search. The results just weren’t good, so I started reading about how to make them better.

What I Learned Building an AI Code Reviewer with Java and Spring Boot

Wed, 14 Oct 2026 00:00:00 +0000

AI-assisted coding has changed how quickly developers can write software.

But that creates another question:

How do you review all that generated code effectively?

That question led me to build CodeGuard AI, a self-hosted AI code-review application for GitHub Pull Requests using Java and Spring Boot.

At first, the architecture seemed simple:

GitHub Pull Request
 ↓
 LLM
 ↓
 Review

In practice, that wasn’t enough. The interesting engineering work was everything around the model: collecting useful Pull Request context, defining review instructions, structuring the model response, assessing findings, and integrating the result back into the GitHub workflow. This article explains what I learned while building that workflow.

No Database Operations Found: What Writing a Spring Boot Analyzer Taught Me About Spring

Thu, 03 Sep 2026 06:26:00 +0000

I spent months building a static analyzer that answers one question about a Spring Boot codebase: if I change this endpoint, what does the change reach?

Every serious bug I found in it had the same shape.

Not a wrong edge in a graph. Not a missing feature. A confident absence — the tool stating, definitively, that an endpoint touched no database, opened no transaction, published no message, when it did all three.

DuckDB in Spring Batch: Replace In-Memory Java Loops with One SQL Statement

Tue, 11 Aug 2026 13:34:43 +0000

Spring Batch jobs usually follow the same pattern: an ItemReader streams rows, an ItemProcessor transforms each one, and an ItemWriter writes them out, chunk by chunk. A chunk-oriented step wires those three pieces together:

new StepBuilder("transform", jobRepository)
 .<Order, Summary>chunk(1_000, transactionManager)
 .reader(reader) // stream rows
 .processor(processor) // transform each row
 .writer(writer) // write the chunk
 .build();

The chunk-oriented processing model (Spring Batch reference).

That pattern works well for moving records between systems.

How to Create a Spring Boot Fraud Scoring Service

Fri, 31 Jul 2026 08:45:43 +0000

Most Java teams who want a machine learning model in production end up standing up a Python service and calling it over HTTP. That works, but it buys you, as a Java developer, a second runtime, a second deployment pipeline, a network hop on every prediction, and a team boundary that turns retraining into someone else’s ticket.

Deep Netts removes that split: it’s a pure-Java deep learning library, so the model trains in Java, serializes to a file, and loads back into your Spring Boot application as an ordinary bean. Predictions become in-process method calls measured in microseconds, with nothing extra to deploy, secure, or monitor.

Getting Started with Exposed: Kotlin ORM Made Simple

Mon, 06 Jul 2026 03:39:00 +0000

Introduction

For quite some time, I have been a huge fan of and fascinated by JetBrains products, tools, and libraries because of their masterful craftsmanship in product creation and their pristine focus on building high-quality developer tools.

Even more excitingly, JetBrains Java Annotated Monthly newsletters have featured most of the technical articles I wrote for Foojay on topics such as Java, Spring, Spring Boot 4, and OpenRewrite.

Recently, one Kotlin Domain-Specific Language (DSL) library caught my attention. I immediately tried converting my existing Spring Boot 4 application from Java to Kotlin using Exposed, an ORM framework for Kotlin. Kotlin SQL Libary

You’re invited to IntelliJ IDEA Conf 2026!

Mon, 29 Jun 2026 18:35:08 +0000

We are excited to invite you to IntelliJ IDEA Conf 2026, a free virtual event on September 8-9, 2026.

IntelliJ IDEA Conf is a celebration of the developer community, bringing together professionals who strive for excellence in software development. Join us for this free, live online conference and learn from industry leaders and experts on September 8-9, 2026.

You’ll be able to learn about a broad range of topics relevant to modern Java and Kotlin development, including language evolution, enterprise Java, Spring-based applications, build tooling, containerized workflows, JVM performance, and data access technologies. For more details, see the agenda below.

Jurassic JDK: Migrate or Extinct

Fri, 26 Jun 2026 07:28:00 +0000

65 million years ago, dinosaurs didn’t adapt. They’re gone. Your JDK 7 app is giving the same energy. 🫠

I spent a year and a half migrating more than 15 projects in production. Full time. Real teams, real deadlines, real 2am breakage. This is everything I wish someone had written before I started.

Why Are We Still Here? 👀

Walk into any company with a codebase older than 5 years and you’ll hear the same thing:

Foojay Podcast #99: Testing the Untestable: LLM Security for Java Developers with Tiberius

Mon, 22 Jun 2026 06:54:00 +0000

Your AI-powered Java application is live in production. But have you actually tested whether it can be jailbroken or manipulated into leaking data it should never reveal? In this episode, Iryna Dohndorf walks us through Tiberius, an open-source security testing library for LLM applications in Java, and explains why everything you know about unit testing needs a rethink when non-determinism is part of the design.

YouTube

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

Ask a Lille Dev

Tue, 16 Jun 2026 00:35:19 +0000

During the DevLille 2026 conference in Lille, I interviewed several Java developers and tech professionals with one simple goal: collecting authentic and spontaneous insights from the Java ecosystem. ☕🎤

The result became “Ask a Lille Dev”, a mini podcast made of short interviews recorded directly during the conference. Instead of long talks or polished marketing speeches, the idea was simple: ask practical questions to people working in tech every day.

AI-Powered Code Review Assistant: Automated Code Analysis with Spring AI and MongoDB

Thu, 14 May 2026 17:09:39 +0000

Code reviews catch bugs before they ship, but they take time. Most teams rely on manual review or basic linters that flag syntax issues but miss deeper problems like subtle resource leaks, poor exception handling, or security anti-patterns. Static analysis tools help, but they work with rigid rules that cannot generalize across code variations. A rule that catches catch (Exception e) {} will miss catch (Throwable t) { return null; }, even though both are the same underlying problem.

Explore Spring AI SDK – Amazon Bedrock AgentCore – Part 3

Sun, 10 May 2026 09:09:00 +0000

In Part 1 and Part 2, we explored the Spring AI SDK and Amazon Bedrock AgentCore features, including the agentcore runtime starter and integration of agentcore memory. In this article, we will explore the integration of AgentCore built-in tools, including the Browser and Code Interpreter features.

Repository containing the companion code for the tutorial. Go to GitHub. Built-In Tool Browser

The use case I am trying to build here is for the given URL; it navigates the entire website and retrieves the content and gives key points and the summary of the page using the AgentCore Browser tool.

Building an AI-Powered Operations Assistant with Spring AI and MongoDB Atlas — Part 1: RAG Foundation

Thu, 07 May 2026 19:22:11 +0000

This is the first article in a three-part series. Part 2 covers short-term and long-term memory; Part 3 introduces stateful workflow checkpointing with pause/resume.

The problem

It’s 2 a.m. Suddenly, an alert pops up indicating abnormal CPU usage on the payment services. The on-call engineer opens their laptop, logs into the monitoring dashboards, and begins the hunt. One by one, he searches the runbooks on Confluence, checks the Slack chats, and opens the GitHub wikis and documents shared during the design phase. By the time he finds any useful information, ten minutes have already passed.

Explore Spring AI SDK – Amazon Bedrock AgentCore – Part 2

Mon, 27 Apr 2026 09:09:00 +0000

If you’re joining us from Part 1 or need a quick refresher on the architecture, listen to this brief overview of how Spring AI and Amazon Bedrock work together. Generated using Notebook LLM for my previous article

In this article, we explore one of the AgentCore capabilities i.e., memory Source: Amazon

To begin, enable AgentCore memory for the agent you built earlier.

Step 1: Add the Ai model and AgentCore memory dependencies

<dependency>
 <groupId>org.springframework.ai</groupId>
 <artifactId>spring-ai-model</artifactId>
</dependency>
<dependency>
 <groupId>org.springaicommunity</groupId>
 <artifactId>spring-ai-agentcore-memory</artifactId>
</dependency>

Step 2: Create Short/Long Term in AWS Management Console

Navigate to Amazon Bedrock AgentCore > Memory to create short/long-term memories. AgentCore Memory

Explore Spring AI SDK - Amazon Bedrock AgentCore - Part 1

Mon, 20 Apr 2026 13:44:54 +0000

Introduction

Artificial intelligence has rapidly expanded across every industry since the inception of ChatGPT. It represents a breakthrough in how we build and use software. Moreover, this breakthrough technology has driven major transformation. At the same time, it has created significant noise and hype.

Today, AI is no longer experimental. Instead, it has become essential, much like electricity and the internet. As a result, it now plays a key role in our daily lives. Overall, this shift reflects strong technological acceleration across industries.

Spring Boot 3.5 EOL — The CVE Blind Spot Nobody Talks About

Sun, 19 Apr 2026 13:37:13 +0000

Tomorrow I start (o so early) for JCON Europe in Cologne and then, at the tail end of the week, go to Devoxx France to give more talks. If you’re at either, come say hi. Herodevs has a booth at both.

After digging into the CVE stories behind Tomcat 8.5’s end of life, I turned my attention to Spring Boot 3.5. Same question, different framework: what actually happens to your security posture when a project crosses the EOL line?

Spring I/O 2026: Field Notes from Barcelona

Fri, 17 Apr 2026 13:09:24 +0000

Spring I/O 2026 wrapped in Barcelona on Wednesday. Three days at the Palau de Congressos. A thousand-plus developers, five tracks, sixty sessions (or there abouts) Here are the things I’m still thinking about..

Agents everywhere

It was a Spring AI conference with a Spring Boot conference attached.

That’s not a complaint. Count the programme yourself. Across the two main days, roughly a third of the main-track sessions were about Spring AI, MCP, agents, or building on LLMs. Josh Long opened Day 2 at eleven with Bootiful Spring Boot 4 . By twelve, the Auditorium had moved on to The Spring AI Ecosystem in 2026: From Foundations to Agents.

Building a Kotlin App with Spring Boot and MongoDB Search

Thu, 09 Apr 2026 15:21:05 +0000

One of my favorite activities is traveling and exploring the world. You know that feeling of discovering a new place and thinking, “How have I not been here before?” It’s with that sensation that I’m always motivated to seek out new places to discover. Often, when searching for a place to stay, we’re not entirely sure what we’re looking for or what experiences we’d like to have. For example, we might want to rent a room in a city with a view of a castle. Finding something like that can seem difficult, right? However, there is a way to search for information accurately using MongoDB Search.

Manage HTTP Sessions with Spring Session MongoDB

Tue, 07 Apr 2026 15:19:10 +0000

Spring Session MongoDB is a library that enables Spring applications to store and manage HTTP session data in MongoDB rather than relying on container-specific session storage. In traditional deployments, session state is often tied to a single application instance, which makes scaling across multiple servers difficult. By integrating Spring Session with MongoDB, session data can be persisted beyond application restarts and shared across instances in a cluster, enabling scalable distributed applications with minimal configuration.

Grails Is Back: Inside the Apache Software Foundation Migration

Wed, 01 Apr 2026 08:48:56 +0000

Grails Isn’t Done Yet (Part 2): EOL, Spring Boot, and What Comes Next

In the companion article to this one, I looked at the revitalisation of Grails under the Apache Software Foundation: the 18-month migration, the technical modernisation, and the release of Grails 7 as a Top-Level ASF Project. That is the good-news story, and it is a genuinely impressive piece of community engineering.

This article is about the other side of the same coin.

Spring Boot Actuator Health for MicroProfile Developers

Thu, 26 Mar 2026 09:30:00 +0000

If you worked with MicroProfile Health, you already understand the value of exposing application health information through standardized endpoints. You know about liveness, readiness and startup probes. You implemented the HealthCheck interface and annotated your procedures with @Liveness, @Readiness and @Startup. Spring Boot Actuator follows a similar philosophy but takes a different architectural approach. This post will help you map your MicroProfile Health knowledge to Spring’s world.

The Conceptual BridgeThe Conceptual Bridge

At its core, Spring Boot Actuator serves the same purpose as MicroProfile Health: it provides a mechanism for validating the availability and status of your application in containerized environments. Both specifications recognize that modern cloud platforms like Kubernetes need machine-readable health information to make decisions about pod lifecycle management.

Grails Is Back: Inside the Apache Software Foundation Migration

Wed, 25 Mar 2026 08:30:21 +0000

Steve Poole | With contributions from James Fredley, Apache Grails PMC Chair

For a technology that many people filed under “legacy,” Grails has been unusually active. While much of the industry’s attention has drifted toward newer frameworks and shinier stacks, something more deliberate has been happening in the background.

Grails has been moving into the Apache Software Foundation (ASF), modernising and positioning itself for the next chapter.

If you have not looked at Grails recently, your mental model is likely several years out of date. And that, in many ways, is exactly the problem.

Introducing the BoxLang Spring Boot Starter: Dynamic JVM Templating for Spring

Thu, 19 Mar 2026 14:20:02 +0000

Spring Boot developers know the pain of evaluating view technologies. Thymeleaf is great — until you need more expressiveness. FreeMarker is powerful — until the syntax fights you. What if you could write templates in a dynamic JVM language that gives you the full power of the platform, feels natural, and requires zero setup to integrate?

Meet the BoxLang Spring Boot Starter.

TL;DR: Drop one dependency into your Spring Boot 3 app and start writing dynamic .bxm templates powered by BoxLang — a modern, expressive JVM language. Zero configuration. Full web scopes. 100% Java interoperable. Not only that, you get full access to BoxLang’s framework capabilities so you can integrate tons of features into your Spring Boot applications:

No Keys, No LLM: Building a Wikidata Definition API with Embabel

Thu, 05 Mar 2026 08:00:25 +0000

TL;DR

I built a Spring Boot 4 API that defines terms via Wikidata.
The app is fully reproducible: no API keys and no model installation needed.
Embabel orchestrates the pipeline as a sequence of actions to achieve the goal DefinitionResult.
The logs show planning, execution, and typed object binding—the most useful part for teaching agentic flows.

No Keys, No LLM: Building a Wikidata Definition API with Embabel

I wanted a demo that is simple , reproducible , and still shows agentic orchestration in a way that’s easy to explain on video.

Tomcat TLSv1.3 cipher configuration

Thu, 26 Feb 2026 18:02:34 +0000

A recent update to Apache Tomcat introduced a subtle but significant change to how TLS cipher suites are configured. If your Spring Boot application explicitly configures TLS ciphers, particularly TLSv1.3 ciphers, and runs on Tomcat 9.0.115+ (Spring Boot 2.x), 10.1.52+ (Spring Boot 3.x), or 11.0.18+ (Spring Boot 4.x), your cipher configuration may be silently ignored.

Prior to the change, Tomcat used a single ciphers attribute on the SSL connector to configure cipher suites for all TLS versions. Starting with the versions of Tomcat listed above (Tomcat commit), this attribute was split:

Machine Learning in Java - SPAM detection using ONNX

Tue, 10 Feb 2026 06:51:50 +0000

Believe it or not, it is possible to do Machine Learning in Java. In this article I go over how to implement a Spring Boot API for Spam Detection using an advanced anti-spam model from the Hugging Face onnx-community and Microsoft’s ONNX Runtime for Java.

We will package the API up as a Docker image which we can run a container from using docker or podman, and I guess in theory you could deploy on your Kubernetes cluster, if you (are) fancy.

Testing Emails with Testcontainers and Mailpit

Thu, 29 Jan 2026 08:38:10 +0000

Testing email functionality is often painful. SMTP servers are external, tests become slow or flaky, and local setups differ from CI environments. As a result, many teams either mock the mail sender or skip proper email tests completely.

Both approaches are unsatisfying. Mocking does not test real behavior, and shared SMTP servers introduce hidden dependencies. What we really want is a real SMTP server that runs locally and in CI, is fully isolated per test run, and allows us to inspect sent emails easily.