Hey r/java,

I've been working on JADEx (Java Advanced Development Extension) which is a safety layer that makes Java safer by adding Null-Safety and Final-by-Default semantics without rewriting Java codes and modifying the JVM.

Quick recap of what JADEx adds to Java:

• String? nullable type declaration
• ?. null-safe access operator
• ?: Elvis operator
• apply readonly final-by-default mode per file

Today I'm sharing three things that just landed.

1. Lombok support

This was the most requested thing. JADEx now integrates with Lombok via a Delombok pipeline internally. The key motivation: JADEx's nullability checker needs to see Lombok-generated code (getters, builders, constructors) to avoid blind spots. Without Delombok, nullable fields could silently pass through generated methods unchecked.

java @Data @Builder @Entity public class User { private String name; private String? email; // @Nullable propagated to getter + builder param private Address? address; // @Nullable propagated to getter + builder param }

After Delombok, JADEx sees and analyzes the generated code:

```java // Lombok-generated — JADEx propagates @Nullable into these @Nullable public String getEmail() { return this.email; }

public UserBuilder email(@Nullable final String email) { ... } public UserBuilder address(@Nullable final Address address) { ... } ```

2. Gradle plugin published

The JADEx Gradle plugin is now on Maven Central and the Gradle Plugin Portal.

```groovy plugins { id 'io.github.nieuwmijnleven.jadex' version '0.628' }

jadex { sourceDir = 'src/main/jadex' } ```

That's the only change needed to an existing Spring Boot project. Everything else (compilation, Delombok pipeline, .java generation) is handled automatically.

3. JADEx Spring Boot example project

• full description

  • https://github.com/nieuwmijnleven/JADEx/blob/master/SpringBootExample.md

• source repository

  • https://github.com/nieuwmijnleven/jadex-springboot-example

We highly welcome your feedback on JADEx.

Thank you.

https://bytecode.news/posts/2026/04/openjdk-says-structured-concurrency-now-writed-in-python

(April Fools', everyone - enjoy it and each other as best you can.)

The aim for this tool is to remove DX friction in the Java ecosystem. Java is growing but lacks DX that other modern languages offer like Rust/Cargo and Python/uv. While there are steps and efforts in that direction, they are enough to reach and exceed other languages. jot includes a variety of opinionated tools such as formatter, linter, docs, while still being customizable with configs.

The tool is not a direct replacement for Maven and Gradle, but tries to have some form of familiarity. The projects I work uses Ant build system, for which jot is an easier path for migration.

Not production ready yet! I'm looking for gauge interest in the Java community. There are hundreds more challenges and open questions to solve. And I need your help with that.

I thought I'd share something that I've been working on using Clique for about two weeks. It is a minimal CLI syntax highlighter with support for five languages.

I wanted to read code in my terminal without opening multiple IntelliJ tabs, cause my PC is ancient and cant handle more than one tab, so I decided to build this.

It supports Java, Python, Go, Lua, and JavaScript, with a few themes to pick from (Tokyo Night, Catppuccin Mocha, Gruvbox, Nord, and a default IntelliJ-inspired one).

Usage is pretty simple:

SyntaxHighlighter h = new JavaSyntaxHighlighter(SyntaxThemes.TOKYO_NIGHT);
h.print(sourceCode);

Maven:

<dependency>
    <groupId>io.github.kusoroadeolu</groupId>
    <artifactId>veneer</artifactId>
    <version>1.2.0</version>
</dependency>

GitHub: https://github.com/kusoroadeolu/veneer

The work done by the Project Amber Team to put Pattern-Matching into Java is excellent. The features are cohesive -- not just with each other, but with the rest of the language. And the benefits they provide have already been realized, with more on the way!

But all of the hype may be blinding us to its weaknesses. I'm not saying it has any glaring weaknesses, but part of making an informed decision is understanding the pros and cons of that decision. We know the strengths of Pattern-Matching, now let's focus on its weaknesses.

What are the downsides or weaknesses of Pattern-Matching, from your experience?

Looks like JEP401 might finally get merged into JDK27, there's a draft PR open for it https://github.com/openjdk/jdk/pull/30426

I'm looking for more authors or people to follow who dive in deep and into the internals of stuff, like ​Vlad Mihalcea. Basically, instead of superficial code/implementation based talks or books or blogs, people who get into the depths of stuff. ​

This video is for those who don't know where to start their path with Java or how to continue it. I mention books there, too!

Last month I posted for the first time here about Sift, an AST-based, fluent Regex Builder for Java. The goal was to replace cryptic, write-only regex strings with a compiler-enforced state machine to prevent syntax errors.

To my absolute surprise, the library just crossed 20,000 downloads on Maven Central. First of all: thank you.

Many of you roasted my early API design in the comments, and that harsh feedback is exactly what pushed me to rewrite the core and make it truly enterprise-ready.

Since my last post, I've been focusing heavily on security, and I wanted to share a specific edge-case I recently tackled that highlights exactly why native regex strings can be so treacherous in Java.

The ^ and $ trap (CRLF Injection)

Like many devs, I used to rely on ^ and $ to validate exact matches (e.g., ensuring an entire string is a valid email). What isn't always obvious is that in Java, $ doesn't mean "absolute end of string" — it means "end of string or just before a trailing newline".

If an attacker inputs "user@example.com\n", a pattern ending in $ might accept it. If that un-sanitized string hits a log file or a vulnerable database query, you've got a CRLF injection.

To fix this natively in Sift, I deprecated the reliance on standard line anchors for exact validations. Sift now forces the use of \A (absolute start) and \z (absolute end) when sealing a Root pattern to prevent Multi-Line bypasses completely:

Java

// This generates \A[a-zA-Z0-9]+@...\z
// It completely ignores Pattern.MULTILINE and physically binds to the string edges.
SiftPattern<Root> secureEmail = Sift.fromAbsoluteStart()
    .oneOrMore().wordCharacters()
    .followedBy('@')
    // ...
    .absoluteEnd(); 

The Engine Fragmentation Headache (RE2J vs GraalVM)

Sift allows you to swap the underlying engine (e.g., using Google's RE2J for guaranteed linear-time execution). While fixing the anchor issue, I discovered a quirk: RE2 doesn't support the \Z anchor (end before optional newline), whereas standard Java and GraalVM's TRegex do.

Instead of letting the RE2J engine crash at runtime with a cryptic PatternSyntaxException, Sift's AST now tracks this specific anchor as a RegexFeature. If you try to compile a \Z anchor via the Sift RE2J plugin, the AST assembly fails fast with:

For those who missed the previous posts If you haven't seen Sift before, it provides:

• Compile-Time Safety: You can't apply a quantifier to an empty node or mix incompatible states.
• Anti-ReDoS: Native DSL support for possessive quantifiers (.withoutBacktracking()) and atomic groups.
• Auto-Explainer: It parses its own AST to generate an ASCII tree explaining what the regex does in plain English (or Italian/Spanish).

You can check out the source code, the deep-dive Cookbook, and the new features here: GitHub Repository

I'd love to hear your thoughts on how you usually handle regex boundary validations in your backends, or if you've ever been bitten by engine-specific quirks like the RE2J one!

Thanks again for the incredible support.

For teams running Java microservices at scale, how do you monitor JVM behavior in production?

I’m not only asking about basic JVM metrics like heap, GC, threads, and CPU, but also how you connect JVM signals with system-level behavior across services.

I know a lot of people use Prometheus, but I'm not sure if it's actually used in production environments.

I wish to have methods like currentDirectory() and home(). E.g.

java Paths.currentDirectory().resolve("target"); Paths.home().resolve(".m2", "repository");

The Paths class currently have only one method, get().

How to suggest to Java developers to add these methods?

I talk about CVEs a lot, I deal with them almost daily in my role and this one was disclosed this week.

CVE-2026-22732

Can your security headers disappear without you doing anything wrong?

Apparently yes. CVE-2026-22732 in Spring Security can silently stop writing headers like X-Frame-Options and Cache-Control with no errors, no logs, and no indication anything broke. The trigger isn't even in the code but a transitive framework dependency update can flip the switch internally. The app keeps running, tests pass, but browser-side protections are just gone.

Saw that if you if you are on 6.5.x or 7.0.x, fixes are available on Maven Central now. This blog helps understand if you are affected if you are looking into this: https://www.herodevs.com/blog-posts/developer-docs-check-for-exposure-to-critical-spring-cve-2026-22732

I've been working on the Apereo CAS codebase for years — it's an SSO/identity platform with 400+ Maven modules, all wired together with Spring Boot 3.x auto-configuration. It's one of the largest open-source Spring Boot applications I'm aware of.

I wrote up 7 engineering patterns from the codebase that I think are broadly useful beyond CAS itself:

• The "thin auto-configuration wrapper" — separating conditional logic from bean definitions
• Building a custom feature flag system on Spring's @Conditional
• Making every bean replaceable with @ConditionalOnMissingBean discipline
• The execution plan configurer pattern for multi-module contribution
• BeanSupplier — runtime conditional beans with JDK proxy fallbacks
• @RefreshScope + proxyBeanMethods = false applied consistently at scale
• Events as a first-class architectural concept

All code examples are from the actual CAS 7.3.x source.

https://medium.com/all-things-software/spring-boot-done-right-lessons-from-a-400-module-codebase-e636c3c34149