Jakarta EE components overview

Jakarta EE is the successor of Java Enterprise Edition. The name change follows the transition of the governance from Oracle to the Eclipse organisation. Jakarta EE9 is simply taking over from Java EE 8 without functional changes. It changes package namespaces to jakarta.* and  removes some obsolete API's. You can find the Java EE evolution up to Java EE8 in an earlier post. From Jakarta EE9 the components are evolving.

Jakarta EE release	9	10	11
year	2020	2022	2025
Requires Java SE	8	11	17
Activation	2.0	2.1
Annotations	2.0.0	2.1	3.0
Authentication	2.0.0	3.0	3.1
Authorization	2.0.0	2.1	3.0
Jakarta Batch	2.0.0	2.1.0
Concurrency	2.0.0	3.0	2.1
Connectors	2.0.0	2.1.0
Contexts and Dependency Injection	3.0	4.0	4.1
Data			1.0
Enterprise Beans	4.0
Expression Language	4.0.0	5.0.0	6.0
Faces	3.0.0	4.0	4.1
Interceptors	2.0	2.1	2.2
JSON Binding	2.0.0	3.0.0
JSON Processing	2.0.0	2.1
Mail	2.0.0	2.1
Messaging	3.0.0	3.1.0
(Server) Pages	3.0	3.1.0	4.0
Persistence	3.0	3.1	3.2
RESTful Web Services	3.0	3.1	4.0
Security	2.0	3.0	4.0
Servlet	5.0	6.0	6.1
Standard Tag Library	2.0.0	3.0.0
Transactions	2.0.0
(Bean) Validation	3.0		3.1
WebSocket	2.0	2.1	2.2
XML Binding	3.0	4.0	X
XML Web Services	3.0	4.0	X
XML Web Services (SOAP with Attachments)	2.0	3.0	X

If a cell is empty in the above table, the version is the same as in the previous release.

An X means a specification is removed.

 The transition to the AI era will be one of the most turbulent times in human history. Right now, we are not preparing adequately for that transition.

    Bill Gates

 

Java 25 quick wins

Here are some simple improvements that Java 25 brings to your everyday code.

Hello World simplified

Since the release of the C programming language, printing "Hello world!" is the first task a programmer does in a language. And Java did not shine at this:

public class HelloWorld {
    public static void main(String[] args) {
        System.out.println("Hello, World!");
    }
}

We tell our students it's magical incantation that they'll have to live with for a while and that all will become clear in due time.

At last Java 25 brings this down to the essentials:

void main() {
    IO.println("Hello, World!");
}

If I'm counting well, we go down from 89 characters to 40 characters,  That's less than half of the code. Additionally the code is more intuitive to understand.

 

This feature is called compact source files. The above improvement uses

• a launchable main method. The method automatically resides in a top level class in the unnamed package
• A new Input/Output class 

Less imports

void main() {
  List<String> ducklings = List.of("Huey", "Dewey", "Louis");
  IO.print("Hello " + ducklings);
}

We're all used to not having to import java.lang.String because Java automatically imports java.lang.*.

Java now automatically imports the java.base module.

Importing a module implies importing all public top level classes and interfaces in packages exported by that module.

The top level packages are defined in the module definitions, which exist since Java 9.

One of the packages exported by the java.base is java.util.*. Hence we do not need

import java.util.List;

for the code above to run anymore.

Additionally a program can now import modules without having to be a module itself, 

making modules more accessible to developers who never dabbled with them themselves.

You import modules (here java.util.desktop) using

import module java.util.desktop;

More flexible constructor bodies

You can now put safe statements before the first call to this(...) or super(...). Safe statements are anything that does not refer (implicitlyu or explicitly) to this.

 

IntelliJ 2026.2 highlights

• logpoints: extend logging breakpoints. They put your logging statements in the IDE (allowing you to put logging in code you do not own). And they allow you to navigate from an execution log to the code producing the log, even if the logging was done from a println in code!
• better dependency completpion  for tools like gradle (finally!)
• Spring Security Inlays for MVC endpoints allowing you to examine appliccable rules and thest them.
• More git conflict resolution proposals
• Better docker)compose.yml support, including the state of running containers 
• typescript 7 support 

Headroom optimizes your AI token use

Headroom is open source software that anaylises the tokens you send to AI and tries to reduce their verbosity before sending them to your AI provider.

Headroom claims to reduce your token consumption by 60-95%. 

OpenAI claims it can decompile binaries

In a move to counter Anthrophic Mythos ApenAI claims it can generate the source code for binaries, with GPT-5.4-Cyber.

Of course, just like Mythos, it is only given to selected companies. 

So... from now on, all software is implicitly open source. 

more... 

windows equivalents for popular unix commands

Some Windows cmd equivalents for common Unix commands and settings for my onw reference

unix	cmd	powershell
echo $variable	echo %variable%	$variable $env:variable //environment variable
~	%USERPROFILE%	$env:USERPROFILE
variable=value	%variable%=value	$variable=value
cp source target	copy source target
cp -r source target	xcopy source target /e/h
find -name '*.txt'	dir /s *.txt
grep text	findstr text
ls -a	dir /a
rm file	del file
rm -rf directory	rmdir /s /q directory
which command	where command	(gcm command).Path

Java 26 released

Java 26 adds HTTP/3 support to the HttpClientApi.

Other features here

How to let AI use a debugger

An interesting read from foojay.io:

Java contains a text base debugger.

As AI also is text based Bruno Borges added a skill to his AI to use the debugger and debug a program.

Check it out! 

European Nato countries can manage their F35 jet software

Dutch defense secretary Gijs Tuinman declared that they can circumvent US restrictions on the software in the F-35 fighter jets they bought in the US, muych like you can jailbrake your phone.

More... 

 

Microsoft warns for AI recommendation poisoning

The Microsoft Defender Security research team published  an article warning for AI recommendation poisoning. 

When using an AI on a website you do not control, you do not know which prompt it actually uses.

Microsoft has  spotted "summarize with AI" buttons that add hidden instructions to give subtly misleading, biased and dangerous results.

The problem extends to any website providing AI  assistance on a variety of topics like health and security. These can be manipulated with AI Memory poisoning, where the system has been pre-populated with biased data, like websites that should be trusted as authoritative sources.

Remember the warnings from Harry Potter and the chamber of secrets: 

Never trust anything that can think for itself 

if you can't see where it keeps its brain.

IntelliJ 2025.3 performance issue

The new IntelliJ 2025.3 pauses frequently.

This is largely due to the new  slick Island theme.

I'm expecting a quick fix, but until then better switch back to one of the older themes (e.g. Light).

more info... 

There is also an annoying migration popup for the move from SQL conzole to SQL files. If you have configured a global datasource, it popz up in EVERY project your open. Issue..

 

 

Trusted browser extensions turn malicious

A set of chrome/edge browser extensions that have been popular for years, turned into malware after an update last year (2024). The extensions, among which Clean Master is the most popular, were publised by Star Laboratary Technology Co. , a Chinese company.

The extensions run malicious JavaScript with full browser access and collecting data on all operations and send them to China. 

More info... 

Spring boot 4 / framework 7 released (updated)

Spring boot 4 was released this week, on the heels of the Spring Framework 7 release. Here are some highlights:

• Upgrades in underlying technology:

• Java 25 (with a Java 17 baseline)
• Gradle 9
• Jackson 3 
• plenty of major releases for Spring modules (Data, AMQP, Batch, BraphQL, HATEOAS, Rest Docs, Security...)

• Completion of the effort to add JSpecify null safety throughout the codebase 
• OpenFeign like support for declarative HTTP Service clients based on annotated interfaces for RestClient, RestTemplate and WebClient.
• Autowired RestTestClient (operating on the underlying MockMvc instance) 
• REST API Versioning
• new JMS Client API 
• Kotlin Serialisation (<-> JSON) 

Chat control approved in EU

 It is a sad day for liberty and privacy in the EU.

Online platforms must monitor activity related to child abuse and take measures to limit the risks. take measures to limit for child abuse. 

Failing to do so, they can be fined. Platforms which are said to have a high risk of containing such material can be forced to implement measures by a national governing authority.

This implies that they will be required to scan all communication. Child abuse is being abused as an argument to scan all communication.

In Belgium we have a long standing right for private communication in postal letters (briefgeheim). We are now losing a part of our freedom. 

 

LLM's get fooled by poets

Italian boffins discovered that trying to sidestep the guards that limit what an AI system will do for you (hacking...) works an order of magnitude better if you phrase your request as a poem.

The approach works accorss all popular models, though some are more vulnerable then others.

This suggest that prompting systems using non standard language will give you a better success rate when trying to abuse AI systems.

more... 

Java SE version history (updated)

Version	Name	Release	Major new features
25 (LTS)		9/2025	simplifications: top level methods, instance main, IO package module imports
16		3/2021	record
15		9/2020	Text blocks
14		3/2020	Switch expressions
11 (LTS)		9/2018	Run (single file) source code
9		2016	JSR 294: modular JDK (Jigsaw) Searchable javadoc
8 (LTS)	Spider	3/2014	JSR 335: lambda expressions Collections Stream Framework JSR 310: Date and Time API Compact profiles JSR 308: annotations outside declarations (on usage)
7	Dolphin	7/2011	language (project coin): switch on strings, multi catch, try with autoclosing resources, empty generics (diamond operator), binary literal, underscores in numbers NIO.2 file handling Fork/Join concurrency JAX-WS 2.2 (SOAP 1.2, WS-I 2.0, metro 2.0)
6	Mustang	12/2006	JSR 223: scripting language support JSR 224: JAX-WS2.0 (metro 1.x) JSR 221: JDBC 4 (driver autoloading)) Perfomance enhancements in synchronisation and garbage collection
5	Tiger	9/2004	language (JSR 201): Enumerations, autoboxing, enhanced for loop, static import, vararg JSR 175: Annotations JSR 14: Generics java.util.concurrent java.util.Scanner RMI automatic stub generation
1.4	Merlin	2/2002	language: assert regular expressions JSR 51: NIO JSR 47: java.util.logging JSR 54: JDBC 3 (metadata API, autogenerated keys, transaction savepoints, multiple || resultsets/statement) security and cryptography
1.3	Kestrel	5/2000	HotSpot JVM RMI/CORBA support JNDI
1.2	Playground	12/1998	Collections Swing JIT compiler Browser plugin JDBC 2.1 (datasources, distributed transactions, connection pooling,RowSet, ResultSet backscrolling and updating )
1.1		2/1997	AWT events reorganisation inner classes JavaBeans JDBC RMI reflection
1.0		1/1996

Here's an overview of Java EE versions

Microsoft disables crash messages on public displays

A public display with an error message is embarassing, both for its owner and for the OS it runs on, and Microsoft has had enough of it.

Microsoft will now offer Digital Signage mode which will optionally turn of a blue screen of death display after 15 seconds.

Congratulations, symptom fight won!

 

 

 

Windows Update Service exploits

Windows Server Update Services (WSUS) are internal Servers that receive softwate updates from Microsoft and distribute these to systems throughout the company.

If these severs (version 2012 and up) are accessible from the internet on their default TCP ports, 8530 (HTTP) and 8531 (HTTPS), they can be exploited. A proof of concept of the attack is available since October 21. Internet servers are currently being actively scanned and exploited by automated hacking scanners.

Over the past month, Microsoft did 2 attempts to patch the vulnerability, but did not succeed: exploits can work around the changes made by microsoft.

Given that  WSUS is an internal software distribution system, it has the potential of distributing malicious code to internal machines.