Tomcat 11: Lenient vs Strict Defaults, Side by Side
A side-by-side comparison of legacy Tomcat defaults and the strict defaults in Tomcat 11, showing which behaviors change and what to verify before you upgrade a Java web tier.
Loading…
Topic
Java
34 posts about Java. Every summary links to the original.
- 34 posts
- 17 companies
- 1 explainer
See the idea
Java explainers
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
IntelliJ IDEA’s Java and Kotlin for Cursor and VS Code Hits 1.0
IntelliJ IDEA’s Java and Kotlin language support extension has reached its 1.0 stable release, now available for VS Code and Cursor editors. The extension is powered by IntelliJ IDEA’s language server and debug adapter, providing smart code completion, navigation, code analysis, refactoring, and build tool support for Maven, Gradle, and Bazel. It also offers powerful debugging capabilities including emulated breakpoints and async stack traces, along with JUnit test runner support. The 1.0 release resulted from close collaboration with the Cursor team, making Java and Kotlin a first-class experience in Cursor’s Agents Window with dedicated support for nullability and Spring Framework specifics. Starting with 1.0, the extension requires an IntelliJ IDEA Ultimate subscription but provides a 30-day free trial, and future updates will enable agents to call the LSP directly for faster AI-assisted development, with announcements pending for purely agentic licensing.
How Netflix Made AI Coding Agents More Efficient with JetBrains IDE Intelligence
Netflix integrated JetBrains’ headless code-intelligence engine into coding agents Claude Code and Codex to address agents’ struggles navigating Java/Kotlin code across compiled JAR boundaries. The engine provides deterministic indexing of project source files and libraries, and Netflix built a daemon and CLI to make the LSP callable by agents, keeping the index warm across repeated calls. In benchmarks on two real codebases—an internal Spring Boot service and the open-source DGS Framework—agents using JetBrains intelligence were typically 20-30% more efficient in tokens and time, with up to 65% improvement for stronger models like Opus 5 at high effort. Correctness held steady or improved across all configurations, and the gains were consistent across every model and agent tested. Netflix plans to extend the same benchmark methodology to Python, TypeScript, and Go, as coding agents for those languages face similar problems.
MongoDB Extension for Hibernate ORM is Now GA
The MongoDB Extension for Hibernate ORM is now generally available as a first-party, open-source library, giving Java teams a production-ready way to use familiar Hibernate APIs with MongoDB’s document model. Developers can continue using @Entity annotations, HQL, Criteria Queries, and Session APIs while building new applications or migrating existing Hibernate workloads from relational databases. The GA release adds JOIN support (INNER and LEFT OUTER) via standard HQL/JPQL syntax, optimistic locking with @Version, Spring Boot auto-configuration that auto-detects dialect and connection provider from the MongoDB JDBC URL, and clearer exception messaging and logging. The extension transparently translates Hibernate operations into MongoDB aggregation pipelines and requires Hibernate ORM 7.4 LTS. It also supports native embedded documents for faster reads and allows dropping into MongoDB’s native Query API for advanced operations like vector search and geospatial queries.
Java and Kotlin by IntelliJ IDEA: The LSP-Based Extension Reaches Release Candidate
JetBrains announced that Java and Kotlin by IntelliJ IDEA, an LSP-based extension, has reached Release Candidate stage. The extension brings IntelliJ IDEA’s Java and Kotlin language intelligence to third-party editors like VS Code and Cursor. Since the preview, it has been downloaded over 20,000 times and includes features such as smart code completion, navigation, inspections, quick-fixes, project-wide refactorings, DAP-based debugging, Maven, Gradle, and Bazel project support, built-in test running, and Spring tooling interoperability. The RC is the final EAP build and will be available for 30 days without a license; after the stable release, a 30-day free trial will be offered, then an IntelliJ IDEA Ultimate subscription is required. The extension also makes its intelligence available to coding agents in Cursor, enabling semantic code search and analysis.
Accelerating airline retailing innovation: how Datalex modernized with AWS Experience-Based Acceleration and agentic AI
Datalex, a leader in airline ecommerce, needed to modernize its mature EJB2/Java 8 system for Modern Airline Retailing while maintaining continuous airline operations. Over three days, 16 Datalex engineers and 6 AWS specialists proved migration feasibility by extracting a Reservation service into a Spring Boot microservice on Java 21. The team used agentic AI tools—Kiro and AWS Transform Custom—to automate code changes, and established repeatable patterns for DevSecOps, observability, and a multi-agent AI prototype via Amazon Bedrock AgentCore. A business service proxy using the Strangler Fig pattern enabled incremental migration with backward compatibility. The board approved significant investment, the prototype team expanded into a full Agile team, and the EBA shortened discovery from an estimated 8–12 weeks to three days.
Upgrading to Red Hat JBoss Web Server 7: Key changes & impacts
Red Hat JBoss Web Server 7, based on Apache Tomcat 11 and Jakarta EE 11, requires Java 17 as the new minimum and drops support for Java 11. Jakarta EE 11 does not require another import rename but adds a RecordELResolver for records and an OptionalELResolver for optionals. Tomcat 11 changes parameter parsing to throw exceptions on malformed requests, reduces maxParameterCount to 1,000 from 10,000, removes FailedRequestFilter and HTTP/2 push, and retains quotes in cookie values per RFC 6265. The Java SecurityManager is removed, UBI 8 images are discontinued for UBI 9, Prometheus is no longer bundled, and Red Hat recommends container isolation as replacement. Teams must confirm Java 17 readiness, check for SecurityManager usage, update their base image pipeline, and note that Spring Boot 4 on JWS 7 is unsupported.
Build OpenJDK container images locally using the standalone S2I tool
Red Hat provides the Red Hat build of OpenJDK for running Java applications on Red Hat OpenShift 4. Developers can use the standalone Source-to-Image (S2I) CLI to build and test OpenJDK container images locally before deploying to a cluster. S2I produces reproducible images by injecting source code into a builder image and running its assemble script. The toolkit supports flags such as –loglevel for detailed output, –environment-file to pass custom JVM settings like G1GC and MaxRAMPercentage, and –as-dockerfile to output a Dockerfile. After building, the image can be tested locally with docker run, then uploaded to the cluster for deployment.
Logpoints Walkthrough
Logpoints in IntelliJ IDEA provide a way to inspect a running Java process without suspending it, making them useful when println logging or regular breakpoints would be disruptive. The walkthrough uses a Dockerized gRPC client and server whose incorrect tenant discount is traced by attaching to the server and adding expressions at runtime, without rebuilding or redeploying. Progressive logging shows the tenant value as JetBrains while the expected value is jetbrains, and the correct-discount block is never entered; the supplied fix uses equalsIgnoreCase and returns 2,000 basis points. The article also demonstrates testing changes through logpoint side effects, extending gRPC deadlines selectively, logging in dependencies, and using the ij-debugger AI agent skill. IntelliJ IDEA 2026.2 adds faster placement and instrumentation that removes debugger-introduced overhead, although heavy expressions still execute in the VM.
Java 27 in IntelliJ IDEA
Java 27, released on September 15, 2026, follows Java’s six-month release cadence and includes nine JEPs: four final features, four previews, and one incubator feature. IntelliJ IDEA supports Java 27 from day one, with setup through Project Structure, automatic JDK configuration from .sdkmanrc or .tool-versions, and language-level controls for stable and preview features. Stable changes include G1 as the default garbage collector in all environments, hybrid post-quantum key exchange for TLS 1.3, compact object headers by default, and JFR in-process data redaction. Preview and incubator work covers lazy constants, primitive types in patterns, instanceof, and switch, PEM cryptographic encodings, and the Vector API, while faster debugger stepping is available through a JDK 27 fix also backported to JBR 25.
Debug Past an HTTP 403 Without Breaking Spring Security
Spring Security can reject a request before execution reaches a controller breakpoint, leaving developers to determine the effective roles and whether bypassing authorization is safe for debugging. IntelliJ IDEA’s security inlays read the live SecurityFilterChain during an active debug session, show role or authority requirements, link to configuration, and let developers unlock an exact URI and HTTP method either with all listed roles or with a chosen username and authority set. The debugger populates an artificial Authentication in the running application’s SecurityContext without changing configuration, while CSRF checks and method-level authorization still apply separately. Unlocks last for the debug session or until relocked, affect every client reaching that route, and have limitations including Servlet-only support, no programmatic API, and a null @AuthenticationPrincipal result.
Java Annotated Monthly – September 2026
Java Annotated Monthly for September 2026 curates Java news, AI-focused writing, Kotlin updates, and items spanning frameworks, tools, community, and events. Its featured coverage examines upcoming JEPs and JDK 27, including claims that compact object headers are enabled by default, reducing headers from 96 to 64 bits, while G1 becomes the default garbage collector. The roundup also points to migration guidance for readers on Java 8 or 11 and includes tutorials on profiling, structured concurrency, virtual threads, retrieval-augmented generation, and JVM security. Additional sections cover Kotlin, AI agents and MCP, Spring and Gradle, developer culture, conferences, and IntelliJ IDEA team articles, including updates on Apache Grails and Spring Boot configuration.
Project Loom in IntelliJ IDEA: Virtual Threads, Scoped Values, and Structured Concurrency
Project Loom in IntelliJ IDEA introduces Java developers to three cohesive concurrency features: Virtual Threads (JEP 444, stable since Java 21), Scoped Values (JEP 506, stable since Java 25), and Structured Concurrency (JEP 533, seventh preview in Java 27). The post identifies pain points such as CompletableFuture ignoring interrupt flags, manual ExecutionException unwrapping chains, duplicated cancel() calls across catch blocks, mutable ThreadLocal pitfalls, and flat thread dumps lacking request hierarchy. A CustomerProfileService example is refactored from CompletableFuture.allOf to StructuredTaskScope.ShutdownOnFailure, where sibling tasks are cancelled automatically and a single timeout covers the whole scope. IntelliJ IDEA debugger support from version 2026.1 groups virtual threads forked within a StructuredTaskScope into containers representing their scopes, and the post walks through downloading JDK 27 (EA) and enabling the experimental language level.
Running AI agents in GitHub Actions with Docker Sandboxes
GitHub Agentic Workflows added support for Docker Sandboxes as an agent runtime, allowing CI coding agents to operate within microVM isolation. Useful AI agents require broad capabilities like executing arbitrary shell commands and launching containers, which elevates risk on shared CI runners. With the docker-sbx runtime, agents receive root privileges and a private Docker daemon inside a dedicated microVM while external repository access and network traffic remain restricted. In a demonstration, an agent ran on an Ubuntu runner, executed Java 21 integration tests with PostgreSQL via Testcontainers, identified an email case-sensitivity defect, applied a code fix, and opened a draft pull request. The complete workflow executed in eleven minutes and sixteen seconds while confining modifications strictly to source files.
Spring Boot Configuration Management Best Practices
Spring Boot externalizes application configuration across files, environment variables, system properties, and command-line arguments to allow a single artifact to run across multiple environments. A resilient setup classifies values into application defaults, deployment configurations, and externalized secrets stored in dedicated vaults. Binding properties to type-safe Java records via @ConfigurationProperties ensures immutability, supports relaxed property mapping, and eliminates the discovery issues common to scattered @Value annotations. Enforcing validation with @Validated and Jakarta Bean Validation constraints triggers fail-fast startup behavior when required settings are absent or malformed. Property precedence determines the effective runtime values, which must be adapted appropriately whether deploying a monolith, containerized workloads in Kubernetes, or a microservices cluster.
Open-sourcing Metals v2: Databricks’ Java and Scala language server for multi‑million line codebases
Databricks open-sourced Metals v2, a Scala and Java language server designed to provide low-latency code intelligence for multi-million-line Bazel monorepos, including its 26M-line repository. The project extends Metals v1 by reworking three layers: a build-free, content-addressed mbt repository index; compiler-backed Scala and Java pipelines using a Metals-provided sourcepath; and metadata-first BSP integration that keeps build synchronization off the startup path. Its Java implementation uses javac APIs and a modified Turbine header compiler, which processes close to one million Java lines per second on one thread and supports interactive analysis at nearly 100,000 lines per second in benchmarks. Metals v2 is available in Cursor, VS Code, and Neovim under Apache 2.0, while Databricks reports Cursor’s share of Scala and Java file-open events rising from 40% to 78%.
Using the GitHub Copilot SDK for Java
The GitHub Copilot SDK for Java offers a framework-agnostic client library to orchestrate AI agent sessions and tool execution directly from server-side Java code. Unlike framework-dependent alternatives, the SDK supports direct model providers such as OpenAI, Azure, and Anthropic through custom endpoint configurations without requiring a Copilot subscription. Developers can register tools declaratively using the experimental @CopilotTool annotation processor or dynamically through inline lambda definitions with ToolDefinition.from. When integrated into a Jakarta EE 11 application on Open Liberty, agent workflows run on container-managed virtual threads that propagate CDI and transaction contexts during blocking calls like sendAndWait. Real-time event subscriptions capture model execution steps and tool invocations to stream updates over WebSockets without exhausting platform threads.
Your OTel spans, our errors: A Sentry love story in one trace
Pointing a standalone OpenTelemetry SDK directly at Sentry ingests spans over standard OTLP, but the spans remain disconnected from Sentry error data. Because the separate SDKs share a process without sharing context, Sentry errors lack active OpenTelemetry trace and span IDs. Sentry introduced OtlpIntegration across backend SDKs including Python, Ruby, Node.js, Go, PHP, .NET, and Java to bridge this gap. The integration reads the active OpenTelemetry context, attaches trace and span identifiers to Sentry events, and configures ingestion. This decoupled model replaces the deeply integrated POTel strategy across most languages, except Java, removing mandatory OpenTelemetry dependencies while maintaining unified trace waterfalls.
Kafka App? There’s a Skill for That
Etsy uses Kafka streams to provide fresh features and embeddings for machine learning models, which infer shopper intent and listing meaning from visits and listing data. Previously, engineers manually assembled Java and YAML applications, selected schemas and base classes, and handled testing and local execution. Etsy introduced conversational Kafka Skills that use language models to interpret requests, pass structured inputs into versioned scaffolding and validation tools, run applications locally, and open pull requests. Telemetry records Skill invocation and pull-request completion through protobuf messages in Kafka and BigQuery, while least-privilege ACLs, repository permissions, and deployment controls constrain agent actions. Initial adoption was low because developers did not know the Skills existed, so Etsy added vocabulary-specific and repository-level entry points; it now has Skills for seven Kafka workflows and is focusing on discoverability.
Scaling Exact COUNT(DISTINCT) for High-Cardinality Non-Rollup Metrics in Distributed Data Pipelines
Uber needed exact COUNT(DISTINCT) for high-cardinality non-rollup metrics such as monthly active users and quarterly retention, where daily or monthly counts cannot be combined and quarterly processing involved 3.6 billion UUID-valued identifiers. RoaringBitmap was exact but failed when a merged bitmap exceeded the JVM’s roughly 2 GB array limit, while HyperLogLog’s 1–5% error was unacceptable for financial reporting. The implemented chunked aggregation buffer hashes each UUID with xxHash64, routes it by the top 16 bits into one of 65,536 Roaring64Bitmap chunks, serializes chunks independently, and returns the final cardinality as an 8-byte long. Across 75 metric families, the deployment reduced two-year backfill time by 65% on average, improved daily runtime by 23%, and recorded no post-deployment OutOfMemoryError failures while retaining exact distinct counts.
Tame Dependabot: Group your updates, slow the cadence, keep security fast
Dependabot often floods repository maintainers with individual daily pull requests for single patch bumps, wasting review and continuous integration resources. Microsoft's GCToolkit project mitigated this issue by updating its dependabot.yml configuration to group dependency updates using wildcard patterns and slowing the schedule interval to monthly. The project also expanded coverage to include Maven alongside GitHub Actions so all relevant package ecosystems receive managed updates. Because Dependabot processes security alerts independently of regular version schedules and enforces a default three-day package cooldown, critical vulnerability fixes remain fast while routine maintenance noise drops significantly.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.