BellSoft

Liberica JDK updates addressing compromised eMudhra certificate chains are now available. Fixed builds: 8u513+9, 11.0.33.0.3+7, 17.0.21.0.3+5, 21.0.13.0.3+5, 25.0.5.0.3+5, and 27.0.1.0.3+5. Download: bell-sw.com/pages/downlo...

Couldn’t make it to Devoxx? Catch @asm0dey.site’s Mission Possible on video. Pasha tackles a Java container image full of CVEs and shows the changes that reduce its exposure, with Dockerfile examples you can reuse. Watch here: youtu.be/1yndLHw9mbo

You can try JSpecify without annotating your whole Java project. @edelveis.dev starts with one package and uses NullAway to catch a bug that would otherwise crash the app. See how to get the checks working: youtu.be/Ymx4hwCsia4

Liberica JDK CPU and PSU updates are out for 6, 7, 8, 11, 17, 21, 25, and 27. 52 CVEs addressed and 1438 fixes and backports overall, with BellSoft contributing to 144 resolved issues. Details: bell-sw.com/blog/liberic... Download: bell-sw.com/pages/downlo...

Security alert: Mitigate risk from compromised eMudhra certificate chains in your Java apps. Liberica JDK updates are underway. To protect your systems now, check your JDK and container images and apply the temporary mitigation: bell-sw.com/blog/distrus...

JDK 28's incubating JSON API lets you construct JSON objects from maps of JSON values. Use JsonString.of() for Java String values. JsonString handles JSON-level escaping, so embedded quotation marks are emitted correctly in the generated JSON text. #Java

Missed the Axelix stream? The replay is up! @edelveis.dev and Axelix CEO Mikhail Polivakha explored how the open source tool finds problems in Java apps, with AI making application quality an even bigger topic. Catch up here: www.youtube.com/watch?v=yv7x...

NullPointerException again? @edelveis.dev tracks down the bug behind a crash and shows why adding a null check can leave you with more debugging to do. Watch the new video: youtu.be/dm_Lgy90ixY

A connect timeout alone is not enough to bound an HTTP request. Java's HttpClient has a client-level timeout for establishing new connections, and HttpRequest can set a per-request timeout for receiving the response. Set connectTimeout() on the client and timeout() on the request. Java 11+. #Java

Switzerland, catch Dmitry Chuyko at your local JUG 🇨🇭 Oct 22 · St. Gallen Know what goes into your Java containers with SBOMs. Oct 26 · Basel Explore Java performance gains without changing your code. Details: www.jug.ch

A package you’ve trusted for years can still ship a compromised release. @edelveis.dev explores zero trust for open source in JAVAPRO, including what a clean CVE scan can miss. Read her article on p. 58 of the free PDF: javapro.io/2026/09/29/a...

Several callers waiting on the same CompletableFuture? orTimeout() times out the future you call it on. Use copy() to give one caller its own timeout without timing out the shared future. Java 9+. #Java

⚡️️️️️️️ We’re live! Join @edelveis.dev and Axelix CEO Mikhail Polivakha for a closer look at the open source tool for finding problems in Java apps, and where it fits into Spring Boot development with AI. Come watch and join the chat: www.youtube.com/watch?v=yv7x...

A semaphore caps concurrent calls, but callers can still wait for a permit. tryAcquire(timeout, unit) puts a bound on that wait, so you can stop waiting when capacity remains unavailable. This only limits permit acquisition. The API call itself still needs its own timeout. Works with virtual threads

Meet Axelix, an open source tool that spots common problems in Java apps at scale. Its CEO Mikhail Polivakha joins @edelveis.dev to explore how it fits into Spring Boot development in the AI era. Oct 12 · 18:00 CEST 🔔 Set a reminder: www.youtube.com/watch?v=yv7x...

Thank you to everyone who stopped by the BellSoft stand at Devoxx Belgium! We hope you enjoyed the conference as much as we did. Thanks also to everyone who took part in our Java and AI survey. We’ll share the results soon. And congratulations to our raffle winner! Enjoy your Meta Quest 3 🎉

Need a rolling average over latency samples? Gatherers.windowSliding(3) builds overlapping windows of three consecutive elements. Map each window to its average, and you get a rolling average directly in the stream pipeline. Java 24+.

Hello from Devoxx Belgium! If you’re here this week, come by stand #13 between sessions to say hi to the BellSoft team and talk Java. There’s a Meta Quest 3 raffle at the stand, too. Fill out our Java and AI survey to take part. See you at the stand!

Tomorrow at @devoxx.com: give your Java container images a security upgrade with @asm0dey.site. Join Mission Possible for practical Dockerfile changes and before/after scans. Oct 7 · 13:05–13:45 CEST · Room 3 See you there! m.devoxx.com/events/dvbe2...

Virtual threads work well for tasks that spend much of their time waiting. A shared Semaphore limits concurrent calls to a downstream service: each task gets its own virtual thread, and up to 10 tasks can enter the protected API at once. Java 21+.

Some buildpacks work outside the vendor’s platform, but their support contracts stop at the door. @edelveis.dev compares eight offerings and the details worth checking before you choose: bell-sw.com/blog/buildpa...

Calling reversed() on an ArrayList does not create a copy. It returns a live reverse-ordered view backed by the original list. Change the view and the original changes too. If you need an independent mutable list in reverse order, create a new ArrayList from the reversed view. Java 21+.

Thanks to everyone who joined JRush Episode 8 live! 💙 We talked about the parts of AI development that don’t fit into a demo: trusting generated code, working with real Java systems, and figuring out where AI helps. Missed the session? The recording is now available:

Gatherers.mapConcurrent() runs stream transformations concurrently on virtual threads, limiting concurrency and preserving stream order. In this example, up to four blocking product lookups can run concurrently, and the resulting list follows the order of the original IDs. Java 24+.

🎙 @asm0dey.site joined Allyson Klein on the podcast with one number from our Spring I/O survey: 64% had never considered whether a Dockerfile affects security. From there, the conversation lands on a much more uncomfortable metric: time from public disclosure to a patched production stack. Listen:

We’re live! 💥 JRush Episode 8 has started. Tune in for real-world stories about AI in Java development: legacy modernization, AI agent workflows, and building a coding process you can trust. Watch live: www.youtube.com/watch?v=nw6C...

JEP 540 brings a simple JSON API to JDK 28 as an incubator module. The jdk.incubator.json module provides a small API for parsing, navigating, and generating JSON. No data binding or streaming APIs. It stays focused on straightforward JSON processing.

A lot of AI experiments never make it past the demo stage. Let’s talk about the ones that do. JRush Episode 8 · Sep 29: jrush.bell-sw.com/episode8

Planning your move to Spring Boot 4? Preview the work before you start. @edelveis.dev takes a demo app from 3.5 to 4.1, with practical fixes and before-and-after code to guide your upgrade. bell-sw.com/blog/how-to-...

20 prompts later and you’re still trying to get AI to write the code you had in mind. @asm0dey.site spent months trying different approaches, moving from endless prompt tweaking to a workflow he uses today. He’ll share what changed in his JRush talk on September 29: jrush.bell-sw.com/episode8

One operation, 500 SQL queries. Would you spot it before production? @edelveis.dev shows how to catch N+1 queries in your logs and fix them without changing your service logic. Watch the Spring Data JPA crash course: youtu.be/jY0mmMcMwCA

You added AI to move faster. So why are you spending your time fixing its code? @edelveis.dev introduces JRush Episode 8 and Simon Martinelli’s talk on AI-driven modernization in enterprise #Java projects. Full details and registration: jrush.bell-sw.com/episode8

Every unnecessary rebuild adds time to a security update. Dmitry Chuyko writes in SD Times about cutting repeated work from CVE patching, especially when the same dependency runs across dozens of apps. sdtimes.com/security/ret...

Martin Ladecký’s Spring I/O talk covers secret hygiene for Java and cloud-native systems, including credentials that can survive in Docker layers and build history. Liberica JDK gets a high five for zero CVEs too. Thanks, Martin ✋ Full talk: www.youtube.com/watch?v=RDqU...

Pasha Finkelshteyn (@asm0dey.site) went through a few AI coding setups before finding one he could trust. At JRush Episode 8, he’ll show the approaches he tested, the one he kept, and the changes that made AI-generated code fit into his own development standards: jrush.bell-sw.com/episode8

Baruch Sadogursky built a software factory with AI agents that shipped a real MVP in three days. 💥 The setup brought together rival coding agents, shared context, and review gates to see what happens when AI agents work as a team. Bring your AI questions to the live session:

Rebase can save you from repeatedly pulling the same gigabytes. A base-image patch doesn't always need a full rebuild. Dmitry Chuyko and @edelveis.dev wrote up where Docker and Buildpacks stand on it: bell-sw.com/blog/rebuild...

Simon Martinelli has spent the last two years applying AI to large #Java systems. At JRush Episode 8, he’ll share lessons from real modernization work: the approaches that helped, the ones that had to be dropped, and the places where AI still needs a careful human hand: jrush.bell-sw.com/episode8

Liberica JDK 27 is out. 🚀 9 JEPs in this release: G1 as the default GC everywhere, post-quantum hybrid key exchange for TLS 1.3, compact object headers by default, JFR data redaction, and more. Plus 2,542 fixes across JDK and JavaFX. Details and downloads: bell-sw.com/blog/liberic...