Tag: java
-
400 Java flaws fixed by centaurs
For the more than 400 flaws, Lightwell engineers backported patches into the widely deployed versions of each library. Any fix that also applies upstream goes back to the open-source project under responsible disclosure protocols while Clearinghouse participants keep their embargo protections. Neither company has named the affected libraries. Behind the fixes, engineers from both companies…
-
Using frontier models to find security problems in Spring Framework – a trickle turned into a tidal wave
“In March, we saw 55 reports coming from the community. In April, that went to 112. April is also when we finally got access to those frontier models and started doing internal scanning, and our internal scans gave us another 370 internal reports.” Michael Minella on the Spring Team. The historical baseline was about seven…
-
Why Java May Finally Get a Standard JSON API
The OpenJDK community has proposed JEP 540: Simple JSON API (Incubator), an effort to provide a lightweight, standard JSON API as part of the Java platform. The proposal is currently under consideration for a future JDK release, including JDK 28. 🔗 Why Java May Finally Get a Standard JSON API
-
Relative to your interests, Tuesday
I have been on vacation for a little while, in Finland for the third time. Finland feels different than the other parts of Europe I have been to. Perhaps it’s because I spent my time there in rural Finland. But it also feels like most of Finland is rural. In that way, it feels a…
-
Enterprise Java apps are much more than just code, AI benchmarks don’t measure the Java SDLC enough
There’s countless dependencies in other frameworks and libraries, plus the build pipeline and even production platform are part of the app. Enterprise Java applications frequently span hundreds or thousands of modules connected through Maven or Gradle builds, Spring dependency injection, Jakarta EE services, annotation processors, generated code, legacy XML configuration, container orchestration, proprietary build plugins,…
-
AI Coding Costs Overtake Salaries, Broadcom’s Intelligence Processor, and sovereign cloud – Related to your interests, Thursday
Defeat AI-Powered Threats with VMware Tanzu Spring Here’s the panel I hosted on how the Spring project is adapting to AI-powered threats. We covered the volume spike in Spring security reports, the kinds of vulnerabilities the models are good at finding, chained “narrative” attacks, the three-bucket fix/fork/ditch triage for open source deps, the clean-room rebuild…
-
Chainguard targets Java’s unpatched vulnerability backlog with drop-in remediated libraries
Chainguard’s CVE remediation capability gives Java shops a fourth option beyond filing exceptions, doing their own backports, or disruptive upgrades: drop-in remediated libraries that keep scanners and auditors satisfied. Summarized by AI. 🔗 Chainguard targets Java’s unpatched vulnerability backlog with drop-in remediated libraries
-
Enterprise Harness Smack-Talk, Forms Don’t Love You Back, and Doing Nothing on Purpose – Related to your interests, Friday
Also: Anthropic’s 80% code claim, and Claude’s quiet enterprise share. From: Broadcom’s Investment in Spring to Combat AI-Fueled Security Challenges in the Enterprise As the chart shows, there’s been a huge jump in CVEs for Spring – this is what’s happening everywhere, you know. My work, Tanzu, has been focusing on this and has changed…
-
security over features
From what I can tell, every core part of the software stack is stopping what they’re doing and taking care of the flood of new, AI-driven security issues. 🔗 Java Maintenance Engineering Shifts Focus on Quarterly Critical Patch Stabilization
-
Aesthetic Computing Consider “ascetic computing”: Here’s what “ascetic computing” means to me: Doing without things that compromise my personal standards or morals. Learning to live Fearlessly in the face of Missing Out. Resisting the Endless Pursuit of Shiny Things. … The goal is to live a (computing) life of principle, purpose, and focus. … Nothing…
-
Histoires Prodigieuses, Forward Deployed Vibes, and Skyrgamur – Related to your interests, Wednesday
Also: Spring still number one, KubeCon AI workloads, the end of Doctor No, and a buyer’s market for employees. Spring still king, from The State of Java 2025, JetBrains. Related to your interests 🤖 From Red Hat OpenShift to VMware Cloud Foundation 9: A Journey to a Unified Cloud Operating Model – A defense-industry case…
-
It was a rather stressful period
Related to your interests Your database is about to become an AI tool. Is it ready? Banks struggle to scale AI as legacy tech devours IT budgets – “Executives said only 29% of annual IT budgets are set aside for transformative technologies while a larger chunk – 43% – is devoted to maintaining legacy systems.”…
-
Why it’s great to be a Spring developer now, and how to make it even better – State of Spring, 2026
This is a talk I give at the start of Spring workshops we do. Here is the recording. The point is to show people that being a Java and Spring developers is fantastic right now. Here’s the description: Spring developers are in a strange position in 2026: everything is changing: AI, platform engineering, enterprise architecture.…
-
There’s a lot of business logic in Java, decades worth…
We have invested a lot in domain models, some of which are even very good. And, to be able to leverage that as we move to the new world is really, really important.” Rod Johnson. Source: “GenAI Grows Up: Building Production-Ready Agents on the JVM,” Rod Johnson, GOTO, October 1st, 2025. That reminds me of…
-
Related to your interests, Thursday
Why it was a Boston vacation. Europe set to treble sovereign cloud investment – “European spending on sovereign cloud infrastructure services is forecast to more than triple from 2025 to 2027 as geopolitical tension drives investment in homegrown services, according to Gartner.” More context: Sovereign Computing, panel – This was a great panel, very detailed…
-
one of the values of Pair Programming is that you have to regularly explain things to your pair. This is an important part of learning – for the person doing the explaining. After all one of the best ways to learn something is to try to teach it. 🔗 Fragments: February 4
-
Relevant to your interests, Wednesday
How the 1944 CIA Sabotage Manual Accidentally Became Your Software Acquisition Playbook – as always, have less meeting. Stellan Skarsgård: ‘Don’t try to be perfect. Tell your children: I’m sorry, I’m a piece of crap, but I love you’ – “I believe that art is important because it allows you to see the world through…
You must be logged in to post a comment.