#maven

Your AI Assistant Is Choosing Your Dependencies

AI code generation doesn't just write your Java. It picks your suppliers, edits your build and pulls in ecosystems you don't know. What Maven developers should check.

adam bien's blog

Multi-stage Docker builds are criticized as an antipattern for Java shops that already have a Maven or Gradle CI/CD pipeline compiling, testing, and versioning artifacts. Rebuilding inside Docker means the image no longer contains the exact artifact that passed the pipeline's tests, just a similar rebuild sharing the same commit. The recommended alternative is a single-stage Dockerfile that copies the already-built jar into a minimal runtime image (e.g. eclipse-temurin:25-jre-alpine), reserving multi-stage builds for cases where Docker itself is the chosen build environment.

Embedding DuckDB in a Maven App (and Using It for Things That Aren’t Databases)

DuckDB là một công cụ cơ sở dữ liệu trong tiến trình (in-process), hoạt động như "SQLite dành cho phân tích dữ liệu", tích hợp trực tiếp vào ứng dụng Java thông qua Maven mà không cần server riêng.

Lập trình viên cần đọc bài này để khám phá cách tích hợp DuckDB vào ứng dụng Maven không chỉ như một cơ sở dữ liệu truyền thống mà là một công cụ phân tích dữ liệu nhẹ nhàng, hiệu quả và không phụ thuộc vào server, giúp tối ưu hóa quy trình xử lý dữ liệu trong ứng dụng.

setup-java v5.5.0: signature verification, Kona JDK, and Maven fixes

The actions/setup-java GitHub Action v5.5.0 introduces cryptographic GPG signature verification for downloaded JDKs (supported for Temurin and Microsoft distributions), adds support for the Tencent Kona JDK distribution, and includes several Maven improvements. New features include a set-default: false option to install a JDK without overriding JAVA_HOME, auto-detection of distribution from .sdkmanrc files, quieter Maven build logs via --no-transfer-progress by default, and a fix for duplicate entries in toolchains.xml. The post also highlights v5.4.0 additions: GraalVM Community distribution, a javac problem matcher for inline PR annotations, and Maven Wrapper caching.

This Dependency Update Looked Exactly Like an Account Takeover

A developer building a dependency scanner noticed that javax.activation dropped its GPG signature between versions — a pattern identical to supply-chain account takeovers like ua-parser-js and event-stream. The investigation revealed a benign cause (Sun-to-Oracle transition), but highlighted a critical blind spot: CVE scanners are lagging indicators and cannot detect compromises before disclosure. To address this gap in the JVM ecosystem, the author built Marshal, an open-source CLI tool (Apache 2.0, Java 21) that scores Maven and Gradle dependency updates on behavioral signals rather than known vulnerabilities. It tracks seven rules including signature drops, new signing keys, dependency count explosions, and repo URL changes. Scores are bucketed GREEN/YELLOW/ORANGE/RED, with RED requiring at least two corroborating signals to reduce false-positive fatigue. The tool integrates with CI via exit codes, supports JSON output, GitHub Actions PR comments, and a strict suppression whitelist with audit trails. v0.2.0 is available now.