50 MB is possible for a real Java REST service.

But once you assess the footprint gains against the trade-offs, things get interesting.

@cat_edelveis tested it with Spring Boot and Quarkus:
youtu.be/2f0LUg5_GvQ

Catch potential NullPointerExceptions while building your Java app.

@cat_edelveis shows how to set up JSpecify + NullAway and try them on a Spring Boot project with a deliberately planted null bug.

Follow the tutorial: bell-sw.com/blog/java-null…

Our Spring container security survey found that 64% of respondents did not recognize how Dockerfile maintenance can affect security.

InfoQ picked up that number in a new piece on patching at scale.

With dozens or hundreds of services, base-image updates stop being a repo-by-repo task and become a platform problem. The article shows where buildpacks fit into that shift:

infoq.com/news/2026/08/b…

What happens when a value object reaches synchronized through an Object reference? With JDK 28 preview features enabled, only identity objects have monitors. If the reference points to a value object, monitor acquisition throws IdentityException.

Use a separate identity object Java

Migration to buildpacks can be smooth.

@cat_edelveis shows how to choose a starting point, switch from a Dockerfile to buildpacks, and test the new image before deployment.

Read the guide: medium.com/buildpacks/mig…

Liberica JDK updates addressing compromised eMudhra certificate chains are now available.

Fixed builds: 8u513+9, 11.0.33.0.3+7, 17.0.21.0.3+5, 21.0.13.0.3+5, 25.0.5.0.3+5, and 27.0.1.0.3+5.

Download: bell-sw.com/pages/downloads

Couldn’t make it to @Devoxx? Catch @asm0di0’s Mission Possible on video.

Pasha tackles a Java container image full of CVEs and shows the changes that reduce its exposure, with Dockerfile examples you can reuse.

Watch here: youtu.be/1yndLHw9mbo

You can try JSpecify without annotating your whole Java project.

@cat_edelveis starts with one package and uses NullAway to catch a bug that would otherwise crash the app.

See how to get the checks working: youtu.be/Ymx4hwCsia4

Liberica JDK CPU and PSU updates are out for 6, 7, 8, 11, 17, 21, 25, and 27.

52 CVEs addressed and 1438 fixes and backports overall, with BellSoft contributing to 144 resolved issues.

Details: bell-sw.com/blog/liberica-…
Download: bell-sw.com/pages/downloads

Security alert: Mitigate risk from compromised eMudhra certificate chains in your Java apps.

Liberica JDK updates are underway. To protect your systems now, check your JDK and container images and apply the temporary mitigation:
bell-sw.com/blog/distrusti…

JDK 28's incubating JSON API lets you construct JSON objects from maps of JSON values. Use JsonString.of() for Java String values.
JsonString handles JSON-level escaping, so embedded quotation marks are emitted correctly in the generated JSON text. #Java

Missed the Axelix stream? The replay is up!

@cat_edelveis and Axelix CEO Mikhail Polivakha explored how the open source tool finds problems in Java apps, with AI making application quality an even bigger topic.

Catch up here: youtube.com/watch?v=yv7xyw…

Thursday 8pm CEST: @asm0di0 from @bellsoftware steers AI agents through design, spec, code while we build a @ASFMavenProject plugin. It writes an interactive HTML page of your dependency graph, conflicts highlighted. youtube.com/live/mufzjT87p… #Java #Maven #AIagents

NullPointerException again?

@cat_edelveis tracks down the bug behind a crash and shows why adding a null check can leave you with more debugging to do.

Watch the new video: youtu.be/dm_Lgy90ixY

A connect timeout alone is not enough to bound an HTTP request. Java's HttpClient has a client-level timeout for establishing new connections, and HttpRequest can set a per-request timeout for receiving the response.
Set connectTimeout() on the client and timeout() on the a

Switzerland, catch @dchuyko at your local JUG 🇨🇭

Oct 22 · St. Gallen
Know what goes into your Java containers with SBOMs.

Oct 26 · Basel
Explore Java performance gains without changing your code.

Details: jug.ch

A package you’ve trusted for years can still ship a compromised release.

@cat_edelveis explores zero trust for open source in @JAVAPROmagazin, including what a clean CVE scan can miss.

Read her article on p. 58 of the free PDF:
javapro.io/2026/09/29/alw…

Several callers waiting on the same CompletableFuture? orTimeout() times out the future you call it on.
Use copy() to give one caller its own timeout without timing out the shared future. Java 9+. #Java

Hardened Buildpacks & Trusted Artifacts (with Cat Edelveis from Bellsoft) x.com/i/broadcasts/1…

⚡️️️️️️️ We’re live! Join @cat_edelveis and Axelix CEO Mikhail Polivakha for a closer look at the open source tool for finding problems in Java apps, and where it fits into Spring Boot development with AI.

Come watch and join the chat: youtube.com/watch?v=yv7xyw…