📚New article! Buildpacks turn source code into a production-ready container image without a Dockerfile. But which buildpacks offering should you choose? Paketo, Heroku, Google, BellSoft, Red Hat, Tanzu, SAP, or Cloud Foundry? Check out the comparison: bell-sw.com/blog/buildpa...

Buildpacks Comparison: CNB, Base OS, Security & Support

Compare Buildpacks and Cloud Native Buildpacks from Paketo, Heroku, Google, Tanzu, BellSoft, Cloud Foundry, Red Hat, and SAP by languages, base OS, security, and support.

bell-sw.com

📑 Don't Trust That Package! My new article explores how zero trust principles can be applied to open source software, from analyzing the project health to gathering and monitoring security signals. Available in the latest JavaPRO PDF issue: javapro.io/2026/09/29/a...

Always Up to Date - with Every New Free PDF Edition! - JAVAPRO International

Don’t Want to Miss a Thing?By subscribing to our news, you’ll get each new PDF edition automatically —…

javapro.io

⚡️Tomorrow at JRush: When AI meets real software development @martinelli.ch , @jbaru.ch , and @asm0dey.site will talk about spec-driven development, coding-agent factories, context, reviews, and engineering decisions belonging to humans. Sign up and see you there! jrush.bell-sw.com/episode8

JRush Episode 8: Java in the Age of AI

AI works in the demo, then falls apart on real code. Three practitioners show what actually works. Live, free, Sept 29. Register now.

jrush.bell-sw.com

Planning your move to Spring Boot 4? Preview the work before you start. @edelveis.dev takes a demo app from 3.5 to 4.1, with practical fixes and before-and-after code to guide your upgrade. bell-sw.com/blog/how-to-...

How to Migrate to Spring Boot 4: Step-by-Step Guide

Learn how to migrate a Spring Boot 3.5 project to Spring Boot 4, including modular starters, Jackson 3, testing changes, deprecated APIs, and migration verification.

bell-sw.com

One operation, 500 SQL queries. Would you spot it before production? @edelveis.dev shows how to catch N+1 queries in your logs and fix them without changing your service logic. Watch the Spring Data JPA crash course: youtu.be/jY0mmMcMwCA

👾Java NullPointerException: Why the Compiler Can't Stop It NPE, the most notorious exception in Java. How does null sneak into your Java code? Is it REALLY a billion-dollar mistake? And how can you prevent NPEs? Watch to find the answers: www.youtube.com/watch?v=dm_L...

Java NullPointerException: Why the Compiler Can't Stop It

YouTube video by CyberJAR

youtube.com

You added AI to move faster. So why are you spending your time fixing its code? @edelveis.dev introduces JRush Episode 8 and Simon Martinelli’s talk on AI-driven modernization in enterprise #Java projects. Full details and registration: jrush.bell-sw.com/episode8

Rebase can save you from repeatedly pulling the same gigabytes. A base-image patch doesn't always need a full rebuild. Dmitry Chuyko and @edelveis.dev wrote up where Docker and Buildpacks stand on it: bell-sw.com/blog/rebuild...

Rebuild vs Rebase Container Images: Docker and Buildpacks

Learn when to rebuild or rebase container images, how Docker Buildx and Buildpacks handle cache and rebasing, and why unchanged layer digests can reduce Kubernetes image pulls.

bell-sw.com

👾 Spring Data JPA Crash Course!! So excited about this! I've tried to make the tutorial on Spring Data JPA with Spring Boot as complete as possible for newbies: entities, relations, repos, JPQL, N+1 solutions, and even new type-safe queries with Boot 4! www.youtube.com/watch?v=jY0m...

Spring Data JPA Crash Course: Entities to N+1 in 23 Minutes

YouTube video by CyberJAR

youtube.com

📖 Neuer Beitrag: Die Jagd nach jedem einzelnen CVE ist sinnlos. Eine bessere Lösung ist ein Schwachstellenmanagementsystem aufzubauen, das sich auf Hardened Images, Build-Provenienz, und Richtlinien für die Behebung von Schwachstellen stützt. javapro.io/de/wie-man-c...

Hardened Images: CVEs in Containern besser verwalten

Erfahren Sie, wie Hardened Images, Provenienz, kontinuierliche Scans und automatisierte Rebuilds helfen, CVEs in Containern kontrolliert zu verwalten.

javapro.io

Season 6 of the @foojay.io #podcast kicks off with the launch of Java 27! @speakjava.bsky.social tells us what's new in this release and what is already known about what's coming in Java 28 from Project Valhalla. www.youtube.com/watch?v=k3aA...

Java 27 in Practice: Smaller Heaps, Smarter Defaults, and Valhalla on the Horizon (#101)

YouTube video by Frank Delporte

youtube.com

Marketing software in the EU? You might have a new strict deadline to meet! One word: CRA. Actually, three. Cyber Resilience Act. Its Article 14 comes into effect today. What are the new rules, who is concerned, and what needs to be done TODAY: youtu.be/IQkzg7quc58

Cyber Resilience Act for Software Vendors: What to Do Now

YouTube video by CyberJAR

youtu.be

👾New on CyberJAR: Migration to Spring Boot 4 Guide Spring Boot 4 is in full bloom🌼 Migrate away from Boot 3 EOL and into the world of new exciting features! Here's how to migrate painlessly and what you and your agents should pay attention to: www.youtube.com/watch?v=qMQg...

Spring Boot 4 Migration Guide: What You Need to Know

YouTube video by CyberJAR

youtube.com

🔖Rebuild or Rebase? What to Do When a Container Image Changes A CVE patch for your base lands - do you need to rebuild the whole image for that? Not necessarily. Me and Dmitry put our heads together and created a guide on efficient image updates: bell-sw.com/blog/rebuild...

Rebuild vs Rebase Container Images: Docker and Buildpacks

Learn when to rebuild or rebase container images, how Docker Buildx and Buildpacks handle cache and rebasing, and why unchanged layer digests can reduce Kubernetes image pulls.

bell-sw.com

Livestream alert! This Friday, I am joined by my fabulous friend @dashaun.com on CyberJAR to discuss how buildpacks promote best security practices and how you can build on that momentum with BellSoft's Hardened Builder for Paketo buildpacks youtube.com/live/3ElGTo5...

How Do You Know It’s Hardened? Anatomy of a Hardened Builder

YouTube video by CyberJAR

youtube.com

👾New on CyberJAR: Implementing Zero Trust in CI/CD Follow a journey of an open source dependency to prod through five security gates, with 3 questions at each: what can go wrong, what evidence do we require, and should it be allowed to continue? www.youtube.com/watch?v=5CzD...

Why Your Pipeline Needs Zero Trust (And How to Build It)

YouTube video by CyberJAR

youtube.com

Liberica JDK CSPU builds are out! CSPUs follow the new accelerated cadence of JDK updates. They are released in-between standard quarterly updates and contain patches for known CVEs and other important security fixes. Update your JDK and stay safe❤️ bell-sw.com/blog/liberic...

Liberica JDK CSPU builds are released

Download Liberica JDK CSPU versions 6, 7, 8, 11, 17, 21, 25 and 26 with improved security.

bell-sw.com

Did you know? Spring Boot 4.1 brings Spring Data 4.1's type-safe property paths enabling devs to use method references instead of strings in data access code: Sort.by("lastname") ➡️ Sort.by(Person::getLastName)

👾New on CyberJAR: Applying Zero Trust to Open Source 10K GitHub stars, zero known CVEs. If these are the only controls you have for OSS, you're inviting trouble. Here's what trust in dependencies SHOULD look like: www.youtube.com/watch?v=Z5jJ...

How to Apply Zero Trust to Open Source Dependencies

YouTube video by CyberJAR

youtube.com

Did you know? No need to always rebuild a container image when the base changes. We can rebase it: replace the runtime base and keep the upper layers unchanged. Buildpacks make it a first-class operation with pack rebase. BuildKit can do smth similar with COPY --link and a cache.

👾New on CyberJAR: What Are Hardened Images? Hardened images are the new black of container security. But what are they? How do they differ from slim or distroless images? How to choose a vendor? And what do teams win by migrating? Find the answers here: www.youtube.com/watch?v=YYw8...

Hardened vs Distroless vs Slim: What's the Real Difference?

YouTube video by CyberJAR

youtube.com

👾New on CyberJAR: Should you use Alpine? What makes Alpine a beloved base for container images? Should you consider it for production workloads, or the trade-offs are not wirth the deal? Find out in my newest video: www.youtube.com/watch?v=37tn...

Is Alpine Linux better? Trade-Offs, Alternatives, and Use Cases

YouTube video by CyberJAR

youtube.com

Buildpacks remove a lot of repetitive containerization work, but they also trade some control for automation. @edelveis.dev breaks down that trade-off in seven minutes, including where a Dockerfile still makes more sense: youtu.be/19ZDEvnjtDI

CyberJAR has been added to Foojay Java In Education Catalog! Thank you, @foojay.io and Igor Souza for recognition. This is an important milestone for CyberJAR, and I promise we will keep the momentum and deliver more content on all things Java☕️ education.foojay.social

Last week, @edelveis.dev and Mohammad-Ali A'râbi had a great conversation about Shai-Hulud, Miasma, Phantom Gyp worms - the latest wave of supply chain attacks. Missed the stream? The full recording is here: www.youtube.com/watch?v=SPly...

The Worms in Your Pipeline: Inside the New Supply Chain Attacks

YouTube video by CyberJAR

youtube.com

Dockerfiles are fine if they are written and maintained well. Then the base image gets old, the runtime needs a bump, and every repo has its own build ritual. @edelveis.dev gets into buildpacks: shared builders, rebasing, SBOMs, and when a Dockerfile still makes sense. bell-sw.com/blog/what-ar...

What Are Buildpacks? Buildpacks vs Dockerfiles Explained

Learn what Cloud Native Buildpacks do, how they compare with Dockerfiles, and how to use them with Java, Python, Go, and Node.js.

bell-sw.com

A smaller image is not automatically a hardened image. @edelveis.dev breaks down slim, distroless, scratch, and hardened images, then shows the Java adoption path: multi-stage builds, SBOMs, signatures, CI/CD checks, and a practical checklist. bell-sw.com/blog/what-ar...

What Are Hardened Container Images? A Comprehensive Guide

Learn what hardened container images are, how they reduce attack surface and CVE noise, and how to adopt them in production.

bell-sw.com

On July 1 at 5 PM CEST, @edelveis.dev is hosting Johannes Bossle for Spec driven design on team level. Prompts work well right up to the point where a whole team has to build and maintain the same system. This session is about what comes next. Set a reminder: www.youtube.com/watch?v=6UqE...

Spec Driven Design on Team Level

YouTube video by CyberJAR

youtube.com

Here is the new #JavaFX #LinksOfTheWeek on www.jfx-central.com/links. Thanks to Marius Hanl Oliver Kopp @ingstudios.dev Mechanical-pasta Marcus Hirt Michael Strauß Jonathan S. Fisher techsenger @frankdelporte.be @davidcalculin.bsky.social Happy reading, and have a lovely #Java weekend!

👾CyberJAR Livestream: Spec Driven Design on Team Level Scaling AI coding workflow across a team is hard. Join me an Johannes Bossle next Wednesday for a live demo on using visual specs, collaboration, and Git to give AI assistants the context teams need. www.youtube.com/watch?v=6UqE...

Spec Driven Design on Team Level

YouTube video by CyberJAR

youtube.com