Friends Of OpenJDK Today on foojay.io - Friends Of OpenJDK

How to Secure a Spring Boot Application with OpenID Connect and pac4j

Fri, 23 Oct 2026 00:00:00 +0000

pac4j is an open-source Java security library for authentication and authorization. It supports protocols such as OpenID Connect, OAuth 2.0, SAML and CAS, with integrations for multiple Java web frameworks. I am Jérôme LELEU, the maintainer of pac4j. In this tutorial, we will use its OpenID Connect client with Spring Boot.

You want users to sign in to your Java application with Keycloak, Google, Microsoft Entra ID, Okta, Auth0 or even a CAS server. They already have an account there, so your application should not ask them for another password.

OWASP Java Security Libraries: Please Update!

Fri, 23 Oct 2026 00:00:00 +0000

Hello Foojay!

I’ve been working hard on bringing two Java security libraries up to date: OWASP Java Encoder and OWASP Java HTML Sanitizer. These libraries are still used in a lot of applications and security products around the world. Both have fresh releases, and I’d love to get more Java developers looking at them again.

My request is pretty simple: please update if you use these! And if they matter to your application, I’d love your feedback.

Android on iOS, Web & Desktop Efficiently and for Free

Thu, 22 Oct 2026 00:00:00 +0000

We are not the first to bring Android to iOS. Earlier projects brought Android’s runtime along with the application. Dalvik was built for Android, including a just-in-time compiler (JIT) that ordinary iOS apps are not permitted to use. Disabling it removes an important source of Dalvik’s performance. Dalvik was designed around interpretation and JIT compilation, not ahead-of-time compilation (AOT), so taking away the JIT leaves an interpreter rather than an optimized native app.

Exact Prices in Java: Decimal Strings and BigDecimal Traps

Thu, 22 Oct 2026 00:00:00 +0000

Prices look like the simplest data there is: a number with a few decimals. Then a crypto price arrives with fifteen decimal places, a token trades at 0.000012341873905, and the numbers on screen stop adding up. This article walks through what goes wrong between the JSON and the screen, and how to keep every digit with BigDecimal and Jackson. For the wider trade-offs between the number types, see double, BigDecimal, or Fixed-Point? on foojay; this article follows one price from the JSON to the screen.

BoxLang 1.18.0 Released: Every Cloud, Every Node, Every Agent

Wed, 21 Oct 2026 00:00:00 +0000

Azure joins the serverless family. Scheduled tasks become cluster-safe. And the whole platform gets documentation and skills built for developers and AI agents working side by side.

If you run a technology organization, you are being asked to do three things at once: ship faster, keep the estate you already have running, and make AI part of how your teams work. Most stacks make you choose. BoxLang 1.18 is another step toward not having to.

BxPlaywright 1.0: Real Browsers, Fluent BoxLang, Built for AI Agents

Wed, 21 Oct 2026 00:00:00 +0000

Ortus Solutions today announces the general availability of bx-playwright 1.0, fluent browser automation and testing for BoxLang, powered by Microsoft Playwright. It ships alongside TestBox 7.2 and ColdBox 8.3, which bring real-browser testing straight into your specs. Drive Chromium, Firefox and WebKit, test full user journeys, render PDFs and images, and give your AI agents a real browser to verify the BoxLang applications they build.

playwright().browse( ( page ) => {
	page.visit( "/login" )
		.fill( "Email", "luis@ortus.com" )
		.fill( "Password", "secret" )
		.click( "Sign in" )
		.assertPathIs( "/dashboard" )
		.assertSee( "Welcome back" )
		.screenshot( "dashboard.png" )
} )

That’s a full login check. It reads like the steps you’d write on a sticky note, and every line runs in a real browser. 🚀

Java Stream Gatherers: From Built-in Patterns to Custom Pipeline Mechanics

Wed, 21 Oct 2026 00:00:00 +0000

Java Stream Gatherers: From Built-in Patterns to Custom Pipeline Mechanics

1. Introduction & Context
2. Getting Started: Built-In Gatherers in Action
- 2.1 Understanding Stream Cardinality
- 2.2 The Five Ready-to-Use Gatherers
3. Leveling Up: From Using Gatherers to Authoring Your Own
- 3.1 When Should You Write a Custom Gatherer?
- 3.2 Pipeline Composition with andThen()
4. Under the Hood: Architecture & Anatomy of Custom Gatherers
5. Production-Ready Gatherers: Parallelism, State, and Pitfalls
6. Conclusion
References

Upgrading from Java 21 to 25: What Actually Breaks

Tue, 20 Oct 2026 00:00:00 +0000

Most “what’s new in Java 25” articles are about what you gain: Scoped Values, flexible constructor bodies, compact source files, Stream Gatherers. This one is about the other side of an LTS-to-LTS upgrade, the things that stop working.

Four years of releases sit between Java 21 and Java 25, and some of what was deprecated in 21 has been removed by 25. Some of it fails loudly, at startup. Some of it fails silently, which is worse: the build is green, the app starts, and the bug shows up a week later.

Foojay Podcast #103: Killing Reflection at Build Time with Dmitry Moskalyuk and Shai Almog

Mon, 19 Oct 2026 00:00:00 +0000

Runtime reflection is one of those quiet taxes on the JVM: it is flexible, it is everywhere, and it is easy to stop noticing it until you go looking for where your CPU is actually going. In this episode, two teams from completely different corners of the ecosystem explain how they went looking and ended up at the same answer: push the work to build time.

Dmitry Moskalyuk is a new author on Foojay. His article “Reflection-Free Serialization on the JVM: Four Formats In, Avro Out” describes a model layer that ingests JSON, XML, YAML and TOML and converts everything to Avro, and the choice between Jackson and kotlinx.serialization that came down to where the reflection cost hides, and where it does not. Shai Almog has been writing on Foojay since 2021 and works on a build-time code generation pipeline for Codename One, with the goal of “no reflection, no service loader, no Class.forName”.

Lottie4J 1.2.7: A Performance Release

Sun, 18 Oct 2026 00:00:00 +0000

A new version of Lottie4J, the Java and JavaFX library to render Lottie animations, is available. Release 1.2.7 doesn’t bring new features, but focuses fully on performance.

Important

USE 1.2.8

The reuse of snapshot images in the matte renderer introduced a regression: animations with track mattes of different sizes could show horizontal streaks during playback (issue #12). This is fixed in Lottie4J 1.2.8, so please use that version instead of 1.2.7.

Pi4J V5.0.0: Work in Progress

Sat, 17 Oct 2026 00:00:00 +0000

What is Pi4J?

Pi4J is an open-source Java library that gives your Java application access to the hardware pins of a Raspberry Pi and other single-board computers. With it, you can blink an LED, read a button, or talk to sensors, displays, and motor controllers over GPIO, PWM, I2C, SPI, and serial, all from plain Java code and without writing any C. The project started more than ten years ago, is now part of the Commonhaus Foundation, and is maintained by a small team of volunteers.

A Smaller, Faster Java Server with a Spring-Style API

Fri, 16 Oct 2026 00:00:00 +0000

What do you pay for Spring and Java’s dynamic architecture? Can you deliver the same API without the same runtime cost?

For a small service, you might want dependency injection, transactions and scheduled jobs without a long startup or a large deployment. That is the case our native Java backend is trying to make. Write a controller and a service, compile their wiring into the application, then deploy a native executable.

Apple Shouldn't Dictate Your App's Redesign Schedule

Fri, 16 Oct 2026 00:00:00 +0000

Apple’s design team doesn’t know what’s on your backlog. A new iOS appearance might be exactly what you want for your next release. It might also arrive halfway through a customer rollout, when changing the navigation is the last thing you need.

We want to support the new SDK without making that decision for you. This week, you can select Xcode 27 on our build servers with the returning ios.xcode_version hint. Local builds and CI also support Xcode 27, and our iOS 27 theme gets more detailed Liquid Glass effects. You choose when to adopt that appearance. Codename One renders most controls itself, so the theme ships with your app. Updating the SDK can leave that theme and your application CSS in place.

Build Your First SaaS with MongoDB Ephemeral Clusters

Fri, 16 Oct 2026 00:00:00 +0000

It’s a new world. A prototype that once meant hours or days of setup can now be up and running in minutes. With one API call, an AI agent can create a MongoDB Atlas cluster from your IDE, so you can start building without stopping to navigate account setup, cloud choices, regions, or cluster configuration.

In this tutorial, you will use an Atlas Ephemeral Cluster to build a polished job-application tracker: a small SaaS where a user manages applications on a Kanban board. The application is deliberately simple. The point is the workflow: give an agent a real database immediately, validate an idea quickly, and claim the cluster only when the prototype is worth keeping.

Lightweight Spring Boot Monitoring Without Prometheus and Grafana

Thu, 15 Oct 2026 00:00:00 +0000

Running one Spring Boot application or a handful of them on a VPS still calls for basic operational visibility. You need to know whether an application is reachable, whether errors are rising, and whether it restarted. You may not need a complete monitoring platform to answer those questions.

Spring Boot Actuator already exposes much of that information through its health endpoint and Micrometer metrics. StatLite turns it into a focused dashboard for health, requests, errors, latency, memory, uptime, and restarts. It runs as one Go binary and stores its history in SQLite.

Scraping websites and bot-protection

Thu, 15 Oct 2026 00:00:00 +0000

While searching for my ancestors, I had to access data from many different websites. I noticed there were different levels of protection against automated access depending on the site. In this post, I’ll list them and mention countermeasures you can take to bypass them anyway.

Warning: As a private person using the data for my own personal use, I have no qualms about bypassing the protection. It can be considered fair use. However, I don’t know about your context, and I’m not saying you should. Scrape responsibly.

One Embedding per Job, or Two? Measuring Semantic Search in a Spring Boot Job Portal

Wed, 14 Oct 2026 00:00:00 +0000

This job portal started as a practice project. I built it after college, mostly so I’d have something to put on my resume. Recently I picked it up again. I was job hunting myself, looking for a switch, and it struck me that I should develop it properly, and maybe even launch it someday.

The first thing that bothered me was search. The results just weren’t good, so I started reading about how to make them better.

What I Learned Building an AI Code Reviewer with Java and Spring Boot

Wed, 14 Oct 2026 00:00:00 +0000

AI-assisted coding has changed how quickly developers can write software.

But that creates another question:

How do you review all that generated code effectively?

That question led me to build CodeGuard AI, a self-hosted AI code-review application for GitHub Pull Requests using Java and Spring Boot.

At first, the architecture seemed simple:

GitHub Pull Request
 ↓
 LLM
 ↓
 Review

In practice, that wasn’t enough. The interesting engineering work was everything around the model: collecting useful Pull Request context, defining review instructions, structuring the model response, assessing findings, and integrating the result back into the GitHub workflow. This article explains what I learned while building that workflow.

What's New In The October 2026 Azul Payara Release?

Wed, 14 Oct 2026 00:00:00 +0000

The October 2026 release brings Payara Community 7.2026.10, as well as Azul Payara Server & Micro 7.5.0, 6.43.0, 5.92.0 & 4.1.2.191.60.

The headline for Payara Community is day-to-day operations. SSH nodes no longer require elevated permissions, two new commands, delete-jvm-option and delete-system-properties, make configuration easier to manage from the command line, and a run of fixes resolves problems that show up in real deployments, from applications failing to deploy after a domain restart to concurrent deployments failing. Three of the changes in this release were contributed by the community (thank you!).

Introduction to Error Prone: How to Catch Bugs at Compile Time

Tue, 13 Oct 2026 00:00:00 +0000

The Java compiler’s job is to check whether code follows the rules of the language. Trying to remove an element from a collection that can never contain it, or using the wrong letter in a date pattern, does not break those rules, so nothing stops the code from compiling. In short, any code that follows the rules compiles, even when it does not do what its author intended.

What is Error Prone?

Error Prone is an open source static analysis tool that Google built to fill this gap. Unlike most static analysis tools, it does not run as a separate step; it plugs into javac as a plugin. Using the information the compiler produces while analyzing the code, it looks for patterns that follow the rules of the language but are most likely wrong, and reports them as compiler warnings or errors.

Testing Jakarta EE: Three Layers, Three Tools

Mon, 12 Oct 2026 00:00:00 +0000

Testing a Jakarta EE application is awkward because the behaviour you care about often doesn’t exist until a container assembles it. Mock everything and your tests pass while proving very little. Deploy everything and you get slow scenarios nobody runs during development.

A recent three-part series by Simon Laden, Testing Jakarta EE: Three Layers, Three Tools, shows how WeldInitiator, Arquillian and Testcontainers each answer a different question. All three parts run on the same example project, testcontainers-example, a small library management system running on Azul Payara Micro. Here is a quick guide to the series.

Your agents don't need an LLM to negotiate

Mon, 12 Oct 2026 00:00:00 +0000

In agents that negotiate, the negotiating usually ends up inside a language model. You describe the situation in a prompt, the model answers, and you parse what comes back. It works, and it costs a network round trip and a line on a bill for every decision.

For the narrow case of handing work to whoever should do it, there’s a protocol that predates all of this. It’s called Contract Net, and it’s small enough to read in an afternoon. Agenor ships it. The example below has a manager hand a job to one of three workers in a single JVM, and its imports contain nothing from any model provider.

Media Partner for OCX27 and jChampions Conference 2027

Sun, 11 Oct 2026 00:00:00 +0000

Foojay is proud to be a media partner for two very different, but equally great, events coming up: OCX 2027 in Brussels and the fully online jChampions Conference 2027.

OCX 2027

We’re excited to be a media partner of Open Community Experience (OCX) 2027. From 13–15 April 2027, developers, maintainers, researchers, engineering leaders, and open source communities from around the world will meet at Tour & Taxis in Brussels, Belgium.

Keep WordPress If You're Looking for Trouble... Or Read This!

Sat, 10 Oct 2026 00:00:00 +0000

I wrote this article by hand. AI was used to review grammar, style, and fact-check the data.

WordPress made it easy for anyone to build a website. So easy that 43% of the web runs on it. Twenty years later, it’s just as easy for anyone to break into one. If that sounds dramatic, keep reading. You can also listen to our podcast on the topic.

11K plugin vulnerabilities in 2025/26 (+42% YoY), exploit time on critical vulnerabilities: 5 hours (source). The question is not if they can pwn your website, it is when.

How to Create Agent Skills: Tools, Testing, and Installation

Fri, 09 Oct 2026 00:00:00 +0000

In short. Start with a task that keeps coming up and turn it into a Skill with superpowers:writing-skills. While creating it, test scenarios with and without the Skill, and validate the structure of SKILL.md. Then use the Skill on several real tasks. If it consistently helps, share it with your team through a Skills repository or a Plugin.

Creating your first Agent Skill is easy. Make a folder, put a SKILL.md file in it, and write a few instructions.

Introducing cbGenesis: The AI-Native ColdBox Starter for BoxLang

Fri, 09 Oct 2026 00:00:00 +0000

Ortus Solutions today announces the general availability of cbGenesis 1.0, a production-ready ColdBox HMVC starter template for BoxLang, and the first one designed from day one to be built with an AI coding agent, not just by one.

For twenty years, ColdBox has been one of the most battle-tested HMVC frameworks in the CFML and BoxLang world. cbGenesis takes that foundation and ships the part every team rebuilds by hand: authentication, permissions, security hardening, an admin panel, tests, and the guidance an AI agent needs to extend all of it correctly.

We Didn't Want to Build Another Java Server

Fri, 09 Oct 2026 00:00:00 +0000

Why Build Another Java Server?

The last thing we wanted to build was another Java server framework. We have Spring, Micronaut, Quarkus, and enough ways to answer an HTTP request to fill a conference schedule.

Introducing Jenesis: You Already Wrote the Build Script

Thu, 08 Oct 2026 00:00:00 +0000

Over the last decade, Java has changed considerably. The language gained modules, records and virtual threads, and the platform moved to a release every six months. The way we build Java applications, however, has barely changed. A pom.xml or a build.gradle.kts still restates what the code already declares, such as the project’s name, its dependencies and its main class. On top of that, every step beyond the defaults adds a block of configuration and typically another plugin, until the build has become a second program that needs to be maintained beside the first. And before a single line of code is compiled, a wrapper first downloads the build tool itself, which in the case of Gradle are 152 MB. This article introduces Jenesis, a build tool that I have written to approach this problem from a different angle.

try.boxlang.io Now Runs Every BoxLang Version, With or Without CFML

Thu, 08 Oct 2026 00:00:00 +0000

The BoxLang playground now lets you choose among released BoxLang versions and switch CFML compatibility on or off without installing a runtime or setting up containers. Choose a version, enter a snippet, and run it in the browser.

Behind the editor is a serverless implementation on AWS Lambda. Each combination of BoxLang version and compatibility mode is built from one repository and deployed as an isolated function. Here’s what changed and how that arrangement works.

Adding RAG to a Jakarta EE 11 App With Only the JDK and Jakarta Specs

Wed, 07 Oct 2026 00:00:00 +0000

The standard story about AI in the enterprise goes something like this. Your app needs AI, so you spin up a Python service. You add a vector database like Pinecone or Weaviate. You pick an orchestration framework. You now have two deployment pipelines, two languages, and two teams. The original Java monolith that handled your business logic just fine becomes one half of a distributed system that exists mostly to connect to the other half.

Friends Of OpenJDK Today on foojay.io - Friends Of OpenJDK

How to Secure a Spring Boot Application with OpenID Connect and pac4j

OWASP Java Security Libraries: Please Update!

Android on iOS, Web & Desktop Efficiently and for Free

Exact Prices in Java: Decimal Strings and BigDecimal Traps

BoxLang 1.18.0 Released: Every Cloud, Every Node, Every Agent

BxPlaywright 1.0: Real Browsers, Fluent BoxLang, Built for AI Agents

Java Stream Gatherers: From Built-in Patterns to Custom Pipeline Mechanics

Java Stream Gatherers: From Built-in Patterns to Custom Pipeline Mechanics

Table of Contents

Upgrading from Java 21 to 25: What Actually Breaks

Foojay Podcast #103: Killing Reflection at Build Time with Dmitry Moskalyuk and Shai Almog

Lottie4J 1.2.7: A Performance Release

Pi4J V5.0.0: Work in Progress

What is Pi4J?

A Smaller, Faster Java Server with a Spring-Style API

Apple Shouldn't Dictate Your App's Redesign Schedule

Build Your First SaaS with MongoDB Ephemeral Clusters

Lightweight Spring Boot Monitoring Without Prometheus and Grafana

Scraping websites and bot-protection

One Embedding per Job, or Two? Measuring Semantic Search in a Spring Boot Job Portal

What I Learned Building an AI Code Reviewer with Java and Spring Boot

What's New In The October 2026 Azul Payara Release?

Introduction to Error Prone: How to Catch Bugs at Compile Time

What is Error Prone?

Testing Jakarta EE: Three Layers, Three Tools

Your agents don't need an LLM to negotiate

Media Partner for OCX27 and jChampions Conference 2027

OCX 2027

Keep WordPress If You're Looking for Trouble... Or Read This!

How to Create Agent Skills: Tools, Testing, and Installation

Introducing cbGenesis: The AI-Native ColdBox Starter for BoxLang

We Didn't Want to Build Another Java Server

Why Build Another Java Server?

Introducing Jenesis: You Already Wrote the Build Script

try.boxlang.io Now Runs Every BoxLang Version, With or Without CFML

Adding RAG to a Jakarta EE 11 App With Only the JDK and Jakarta Specs