http://foojayio.github.io/website/sponsor/herodevs/Articles from HeroDevs on foojay.io - Friends Of OpenJDKHugoen-usTue, 18 Aug 2026 14:01:20 +0000http://foojayio.github.io/website/today/vibe-coding-maven-and-the-dependencies-you-didnt-choose/Tue, 18 Aug 2026 14:01:20 +0000JavaSecurityhttp://foojayio.github.io/website/today/vibe-coding-maven-and-the-dependencies-you-didnt-choose/AI code generation doesn't just write your Java. It picks your suppliers, edits your build and pulls in ecosystems you don't know. What Maven developers should check.http://foojayio.github.io/website/today/ai-found-the-bugs-whos-patching-your-eol-java-code/Thu, 23 Jul 2026 15:26:53 +0000AIJavaSecurityhttp://foojayio.github.io/website/today/ai-found-the-bugs-whos-patching-your-eol-java-code/AI finds decades-old flaws at machine speed, but the fixes only reach supported versions. What that means for end-of-life Java, and what to do.http://foojayio.github.io/website/today/foojay-podcast-100/Mon, 13 Jul 2026 07:05:59 +0000FoojayJavaPodcasthttp://foojayio.github.io/website/today/foojay-podcast-100/Foojay Podcast hits episode 100. No plan, no roadmap. It just happened. To mark the occasion, Frank turned the microphone around and invited other…http://foojayio.github.io/website/today/7-new-vulnerabilities-in-jackson-in-one-day-this-is-what-ai-assisted-security-research-looks-like/Mon, 29 Jun 2026 11:47:41 +0000JavaSecurityhttp://foojayio.github.io/website/today/7-new-vulnerabilities-in-jackson-in-one-day-this-is-what-ai-assisted-security-research-looks-like/Seven jackson-databind vulnerabilities, one researcher, one day. Two critical RCEs. This is AI-assisted security research in practice.http://foojayio.github.io/website/today/did-ai-just-break-software-security-for-ever/Tue, 16 Jun 2026 14:51:04 +0000JavaSecurityhttp://foojayio.github.io/website/today/did-ai-just-break-software-security-for-ever/AI finds exploits in hours. Patch cycles run 30–60 days. EOL software gets neither. Here's what changed in 2026 and what to do about it.http://foojayio.github.io/website/today/spring-boot-migration-and-the-cra-when-good-enough-isnt/Fri, 05 Jun 2026 08:52:01 +0000JavaSecurityhttp://foojayio.github.io/website/today/spring-boot-migration-and-the-cra-when-good-enough-isnt/Spring Boot 3.5 reaches EOL on June 30. The legal context is about to change. Here's what 'without undue delay' means when commercial patches exist..http://foojayio.github.io/website/today/foojay-podcast-95/Mon, 11 May 2026 09:57:00 +0000JavaJava CorePodcastSecurityhttp://foojayio.github.io/website/today/foojay-podcast-95/Is your Java application actually secure, or does it just look that way? In this episode of the Foojay Podcast, Frank is joined by Steve Poole and David…http://foojayio.github.io/website/today/crossing-the-river-styx-spring-boot-3-5-and-the-zombie-dependency-problem/Sun, 19 Apr 2026 13:37:13 +0000JavaSecuritySpringhttp://foojayio.github.io/website/today/crossing-the-river-styx-spring-boot-3-5-and-the-zombie-dependency-problem/Spring Boot 3.5 goes EOL June 30, 2026. But the real risk isn't the migration. It's what happens to CVE reporting once a project reaches end of life.http://foojayio.github.io/website/today/spring-i-o-2026-field-notes-from-barcelona/Fri, 17 Apr 2026 13:09:24 +0000JavaSpringhttp://foojayio.github.io/website/today/spring-i-o-2026-field-notes-from-barcelona/Three days at Spring I/O 2026 in Barcelona. Agents, Embabel, the sessions that didn't get the main stage, and a booth full of dragonshttp://foojayio.github.io/website/today/why-java-developers-over-trust-ai-dependency-suggestions/Thu, 09 Apr 2026 10:45:36 +0000JavaSecurityhttp://foojayio.github.io/website/today/why-java-developers-over-trust-ai-dependency-suggestions/AI coding tools sound confident even when they're wrong. Here's the psychology behind why Java developers accept bad suggestions — and habits that help.http://foojayio.github.io/website/today/grails-isnt-done-yet-part-2-eol-spring-boot-and-what-comes-next/Wed, 01 Apr 2026 08:48:56 +0000Springhttp://foojayio.github.io/website/today/grails-isnt-done-yet-part-2-eol-spring-boot-and-what-comes-next/Grails graduated to a Top-Level Apache project in 2025. Here's what the 18-month migration, Grails 7 release, and Spring Boot alignment mean for teams still running it.http://foojayio.github.io/website/today/grails-isnt-done-yet-part-1-inside-the-asf-reboot/Wed, 25 Mar 2026 08:30:21 +0000Developer ToolsInterviewsJavaSpringToolshttp://foojayio.github.io/website/today/grails-isnt-done-yet-part-1-inside-the-asf-reboot/Grails graduated to a Top-Level Apache project in 2025. Here's what the 18-month migration, Grails 7 release, and Spring Boot alignment mean for teams still running it.http://foojayio.github.io/website/today/tomcat-tlsv13-cipher-configuration-spring-boot/Thu, 26 Feb 2026 18:02:34 +0000Apache TomcatJavaSecuritySpringhttp://foojayio.github.io/website/today/tomcat-tlsv13-cipher-configuration-spring-boot/A Tomcat update splits TLSv1.3 cipher configuration into a new attribute, silently dropping your Spring Boot cipher restrictions. Here's how to fix it.http://foojayio.github.io/website/today/the-shai-hulud-cyber-worm-and-more-thoughts-on-supply-chain-attacks/Thu, 12 Feb 2026 11:47:48 +0000DevOpsSecurityhttp://foojayio.github.io/website/today/the-shai-hulud-cyber-worm-and-more-thoughts-on-supply-chain-attacks/first, a word about ecosystems Before we dive into Shai-Hulud, before we label it “sophisticated” or “advanced” or “next generation,” we need to be honest…http://foojayio.github.io/website/today/fosdem-2026-and-the-open-source-firehose/Mon, 02 Feb 2026 22:52:20 +0000AIConferenceEventsTrip Reportshttp://foojayio.github.io/website/today/fosdem-2026-and-the-open-source-firehose/Is open source hitting a watershed moment? After 8,000 developers converged for FOSDEM 2026, it’s clear that legal obligations and supply chain security are rewriting the rules. Discover why the…http://foojayio.github.io/website/today/security-doesnt-start-at-liftoff/Fri, 23 Jan 2026 10:22:31 +0000Securityhttp://foojayio.github.io/website/today/security-doesnt-start-at-liftoff/This is a follow-on to the article The Real Mechanics of Vulnerabilities in an Upstream/Downstream, Topsy-Turvy EOL World. What you'll learn in this…