BellSoft✓

What happens when a value object reaches synchronized through an Object reference? With JDK 28 preview features enabled, only identity objects have monitors. If the reference points to a value object, monitor acquisition throws IdentityException. Use a separate identity object when you need a lock. #Java

Migration to buildpacks can be smooth. @cat_edelveis shows how to choose a starting point, switch from a Dockerfile to buildpacks, and test the new image before deployment. Read the guide:

Liberica JDK updates addressing compromised eMudhra certificate chains are now available. Fixed builds: 8u513+9, 11.0.33.0.3+7, 17.0.21.0.3+5, 21.0.13.0.3+5, 25.0.5.0.3+5, and 27.0.1.0.3+5. Download:

Couldn’t make it to @Devoxx? Catch @asm0di0’s Mission Possible on video. Pasha tackles a Java container image full of CVEs and shows the changes that reduce its exposure, with Dockerfile examples you can reuse. Watch here:

You can try JSpecify without annotating your whole Java project. @cat_edelveis starts with one package and uses NullAway to catch a bug that would otherwise crash the app. See how to get the checks working:

Liberica JDK CPU and PSU updates are out for 6, 7, 8, 11, 17, 21, 25, and 27. 52 CVEs addressed and 1438 fixes and backports overall, with BellSoft contributing to 144 resolved issues. Details: Download:

Security alert: Mitigate risk from compromised eMudhra certificate chains in your Java apps. Liberica JDK updates are underway. To protect your systems now, check your JDK and container images and apply the temporary mitigation:

JDK 28's incubating JSON API lets you construct JSON objects from maps of JSON values. Use JsonString.of() for Java String values. JsonString handles JSON-level escaping, so embedded quotation marks are emitted correctly in the generated JSON text. #Java

Missed the Axelix stream? The replay is up! @cat_edelveis and Axelix CEO Mikhail Polivakha explored how the open source tool finds problems in Java apps, with AI making application quality an even bigger topic. Catch up here:

RT @JohannesRabauer: Thursday 8pm CEST: @asm0di0 from @bellsoftware steers AI agents through design, spec, code while we build a @ASFMavenProject plugin. It writes an interactive HTML page of your dependency graph, conflicts highlighted. #Java #Maven #AIagents

NullPointerException again? @cat_edelveis tracks down the bug behind a crash and shows why adding a null check can leave you with more debugging to do. Watch the new video:

A connect timeout alone is not enough to bound an HTTP request. Java's HttpClient has a client-level timeout for establishing new connections, and HttpRequest can set a per-request timeout for receiving the response. Set connectTimeout() on the client and timeout() on the request. Java 11+. #Java

Switzerland, catch @dchuyko at your local JUG 🇨🇭 Oct 22 · St. Gallen Know what goes into your Java containers with SBOMs. Oct 26 · Basel Explore Java performance gains without changing your code. Details:

A package you’ve trusted for years can still ship a compromised release. @cat_edelveis explores zero trust for open source in @JAVAPROmagazin, including what a clean CVE scan can miss. Read her article on p. 58 of the free PDF:

Several callers waiting on the same CompletableFuture? orTimeout() times out the future you call it on. Use copy() to give one caller its own timeout without timing out the shared future. Java 9+. #Java

RT @dashaun: Hardened Buildpacks & Trusted Artifacts (with Cat Edelveis from Bellsoft)

⚡️️️️️️️ We’re live! Join @cat_edelveis and Axelix CEO Mikhail Polivakha for a closer look at the open source tool for finding problems in Java apps, and where it fits into Spring Boot development with AI. Come watch and join the chat:

Axelix: Controlling the Quality of Spring Boot Apps in the AI Era

RT @dashaun: Hardened images ship with no shell, no package manager, no download utilities. Immutable and near-zero CVEs, kept clean by a maintainer who patches on release. #HardenedImages #CVE #Containers

A semaphore caps concurrent calls, but callers can still wait for a permit. tryAcquire(timeout, unit) puts a bound on that wait, so you can stop waiting when capacity remains unavailable. This only limits permit acquisition. The API call itself still needs its own timeout. Works with virtual threads. #Java