20 prompts later and you’re still trying to get AI to write the code you had in mind. @asm0di0 spent months trying different approaches, moving from endless prompt tweaking to a workflow he uses today. He’ll share what changed in his JRush Episode 8 talk on September 29: jrush.bell-sw.com/episode8

One operation, 500 SQL queries. Would you spot it before production? @cat_edelveis shows how to catch N+1 queries in your logs and fix them without changing your service logic. Watch the Spring Data JPA crash course: youtu.be/jY0mmMcMwCA

You added AI to move faster. So why are you spending your time fixing its code? @cat_edelveis introduces JRush Episode 8 and Simon Martinelli’s talk on AI-driven modernization in enterprise #Java projects. Simon spent two years working with AI on large applications. He’ll share what teams learned from applying AI to real systems, including what to hand over and what still needs a human review. Full details and registration: jrush.bell-sw.com/episode8

Scaling Java Without Overloading Your Database: Meet Open J Proxy 1.0 nitter.cf/i/broadcasts/1vJpPNWEb…

Every unnecessary rebuild adds time to a security update. @dchuyko writes in SD Times about cutting repeated work from CVE patching, especially when the same dependency runs across dozens of apps. sdtimes.com/security/rethink…

Martin Ladecký’s Spring I/O talk covers secret hygiene for Java and cloud-native systems, including credentials that can survive in Docker layers and build history. Liberica JDK gets a high five for zero CVEs too. Thanks, Martin ✋ Full talk: youtube.com/watch?v=RDqUVQEf…

Pasha Finkelshteyn (@asm0di0) went through a few AI coding setups before finding one he could trust. At JRush Episode 8, he’ll show the approaches he tested, the one he kept, and the changes that made AI-generated code fit into his own development standards. The stream is free. Save your spot: jrush.bell-sw.com/episode8

Baruch Sadogursky built a software factory with AI agents that shipped a real MVP in three days. 💥 The setup brought together rival coding agents, shared context, and review gates to see what happens when AI agents work as a team. @jbaruch is Head of Developer Relations at Port.io and a Java Champion. At JRush Episode 8, he’ll share the process behind the experiment and the lessons from building it. Bring your AI questions to the live session: jrush.bell-sw.com/episode8

Rebase can save you from repeatedly pulling the same gigabytes. A base-image patch doesn't always need a full rebuild. @dchuyko and @cat_edelveis wrote up where Docker and Buildpacks stand on it: bell-sw.com/blog/rebuild-or-…

Sometimes, you end up being responsible for vulnerable code you didn't even write. A vulnerable JDK. A compromised package. An outdated base image. Third-party components become part of your product the moment they are shipped with it. Under the CRA, if an actively exploited vulnerability is in a third-party component integrated in your product, it can become your reporting responsibility if this vulnerability can be exploited in your product. This is why visibility into third-party components is important for timely response. BellSoft Hardened Images can simplify this task for the base image layer. Each image comes with an SBOM, BellSoft continuously monitors the images for newly discovered CVEs, and commercial plans provide SLA-backed remediation. You still need to determine if a vulnerability is exploitable in your product. But if it stems from the base image, you have complete data about base image contents and a defined remediation process from the image vendor. Learn more about BellSoft Hardened Images: bell-sw.com/bellsoft-hardene…

Simon Martinelli has spent the last two years applying AI to large #Java systems. At JRush Episode 8, he’ll share lessons from real modernization work: the approaches that helped, the ones that had to be dropped, and the places where AI still needs a careful human hand. 🏆 @simas_ch is a Java Champion and creator of the AI Unified Process. Don’t miss the live session: jrush.bell-sw.com/episode8

Liberica JDK 27 is out. 🚀 9 JEPs in this release: G1 as the default GC everywhere, post-quantum hybrid key exchange for TLS 1.3, compact object headers by default, JFR data redaction, and more. Plus 2,542 fixes across JDK and JavaFX. Details and downloads: bell-sw.com/blog/liberica-jd…

A critical CVE lands in your product. Do you need to report it within 24 hours under the CRA? Not necessarily. For manufacturers, a vulnerability becomes mandatorily reportable when there is reliable evidence that a malicious actor has actually exploited it. Severity alone does not trigger the reporting obligation. A proof of concept with no evidence of malicious exploitation? No mandatory Article 14 vulnerability report. A zero-day found by a testing lab, but no evidence that anyone has exploited it? Same answer. Severe security incidents are a separate reporting track. If an incident seriously affects, or could seriously affect, the security of the product, it needs to be reported. So, severity alone does not decide whether a vulnerability has to be reported under Article 14. Evidence of actual malicious exploitation does. ENISA covers more reporting cases in its FAQ: enisa.europa.eu/topics/produ…

After years of Project Valhalla work, value objects are coming to JDK 28 as a preview feature. JEP 401 introduces objects without identity. For value objects, == compares their values instead of object identity. Two separately created ValuePoint instances with the same fields are indistinguishable, while regular objects still keep identity-based comparison. First preview.

AI is moving from experiments into real Java projects. But what happens when it hits legacy systems, production constraints, and teams that need predictable results? JRush Episode 8 brings three engineers sharing what they learned from using AI for modernization, coding workflows, and building with AI agents. Free live event · September 29 Register: jrush.bell-sw.com/episode8

September 11 has passed. If a reportable event showed up tomorrow, would your team know what to do? If you had to think about it, we pulled the reporting process into a six-page cheat sheet for EU Cyber Resilience Act reporting. It starts with the prep work worth doing before anything happens, then follows the reporting flow through the 24-hour notification, the 72-hour update, user communication, and the final report. It also covers the less obvious setup around Assigned Representatives, CSIRT selection, and the product information you need to have ready. There’s a checklist at the end for the things you don’t want to be figuring out under a 24-hour deadline: bell-sw.com/cra-reporting-gu…

Selling software in the EU? Today the rules changed. Article 14 of the Cyber Resilience Act is now in force, and for manufacturers that means a new reporting obligation with a first deadline of just 24 hours. What actually needs to be reported? Who is responsible? And what should be in place before that timer starts? Watch here: youtu.be/IQkzg7quc58

CRA reporting starts today. As of September 11, the first reporting obligations under the Cyber Resilience Act are in effect, and ENISA's Single Reporting Platform is now live. Manufacturers can use it to report actively exploited vulnerabilities and severe security incidents affecting products with digital elements on the EU market. The reporting sequence has several deadlines to keep straight. An early warning is due within 24 hours of becoming aware of a reportable event, followed by a more detailed notification within 72 hours. The final deadline depends on what happened. For an actively exploited vulnerability, the final report is due within 14 days after a corrective measure becomes available. For a severe incident, it is due within one month after the 72-hour notification. ENISA Single Reporting Platform: enisa.europa.eu/topics/produ…

Who actually needs to care about the CRA? If your company puts software or hardware on the EU market under its own name, September 11 is a date worth knowing about. The Cyber Resilience Act covers products with digital elements, from applications and operating systems to routers and connected devices. But the rules depend on the role your company plays in bringing a product to the market. For the new reporting obligations, two groups are particularly relevant: manufacturers and in-scope open-source software stewards. A manufacturer is a company or individual that develops a product, or has it developed, and makes it available on the EU market under its own name or trademark. That could be a company selling its own application, an operating system vendor, or a manufacturer putting a connected device on the market with its own software. Then there are open-source software stewards. This category covers legal entities that systematically and sustainably support the development of open-source software intended for commercial activity and play a main role in ensuring its viability. A developer who simply contributes code to an open-source project generally does not fall into this category. The distinction matters because the CRA places reporting responsibilities on these roles, while ordinary open-source contributors are generally outside its scope. So the useful question to ask now is pretty simple: what role does your company have in the products it makes available in the EU? More details in the ENISA CRA Single Reporting Platform FAQ: enisa.europa.eu/topics/produ…

Java 27 is almost here, and JEP 536 adds in-process redaction to JFR. JFR can now redact command-line arguments, initial values of environment variables, and system properties before they reach the recording. Default filters cover common sensitive names such as passwords and tokens.