Catherine Edelveis

BIG NEWS from BellSoft: we have introduced Hardened Container Images! These are minimized images with immutable component set, up to 95% fewer CVEs and a single SLA from one team that covers OS, runtime, and vulnerability management ➡️ bell-sw.com/bellsoft-har...

How small can a Java container image realistically be? Containers with Java apps have the reputation of being bloated. How true is it today? Can a typical framework-based Java REST service fit into a 50MB container? And 30MB? Watch my experiment: youtu.be/2f0LUg5_GvQ

A package you’ve trusted for years can still ship a compromised release. @edelveis.dev explores zero trust for open source in JAVAPRO, including what a clean CVE scan can miss. Read her article on p. 58 of the free PDF: javapro.io/2026/09/29/a...

👾New on CyberJAR: 10 Questions about JSpecify and Null-Safety in Java What JSpecify does to and for your Java code? What it needs? Which other tool is necessary to REALLY catch NPE before prod? And how to migrate to JSpecify safely? Watch and find out: www.youtube.com/watch?v=Ymx4...

Meet Axelix, an open source tool that spots common problems in Java apps at scale. Its CEO Mikhail Polivakha joins @edelveis.dev to explore how it fits into Spring Boot development in the AI era. Oct 12 · 18:00 CEST 🔔 Set a reminder: www.youtube.com/watch?v=yv7x...

📚New article! Buildpacks turn source code into a production-ready container image without a Dockerfile. But which buildpacks offering should you choose? Paketo, Heroku, Google, BellSoft, Red Hat, Tanzu, SAP, or Cloud Foundry? Check out the comparison: bell-sw.com/blog/buildpa...

📑 Don't Trust That Package! My new article explores how zero trust principles can be applied to open source software, from analyzing the project health to gathering and monitoring security signals. Available in the latest JavaPRO PDF issue: javapro.io/2026/09/29/a...

⚡️Tomorrow at JRush: When AI meets real software development @martinelli.ch , @jbaru.ch , and @asm0dey.site will talk about spec-driven development, coding-agent factories, context, reviews, and engineering decisions belonging to humans. Sign up and see you there! jrush.bell-sw.com/episode8

Planning your move to Spring Boot 4? Preview the work before you start. @edelveis.dev takes a demo app from 3.5 to 4.1, with practical fixes and before-and-after code to guide your upgrade. bell-sw.com/blog/how-to-...

One operation, 500 SQL queries. Would you spot it before production? @edelveis.dev shows how to catch N+1 queries in your logs and fix them without changing your service logic. Watch the Spring Data JPA crash course: youtu.be/jY0mmMcMwCA

👾Java NullPointerException: Why the Compiler Can't Stop It NPE, the most notorious exception in Java. How does null sneak into your Java code? Is it REALLY a billion-dollar mistake? And how can you prevent NPEs? Watch to find the answers: www.youtube.com/watch?v=dm_L...

You added AI to move faster. So why are you spending your time fixing its code? @edelveis.dev introduces JRush Episode 8 and Simon Martinelli’s talk on AI-driven modernization in enterprise #Java projects. Full details and registration: jrush.bell-sw.com/episode8

Rebase can save you from repeatedly pulling the same gigabytes. A base-image patch doesn't always need a full rebuild. Dmitry Chuyko and @edelveis.dev wrote up where Docker and Buildpacks stand on it: bell-sw.com/blog/rebuild...

👾 Spring Data JPA Crash Course!! So excited about this! I've tried to make the tutorial on Spring Data JPA with Spring Boot as complete as possible for newbies: entities, relations, repos, JPQL, N+1 solutions, and even new type-safe queries with Boot 4! www.youtube.com/watch?v=jY0m...

📖 Neuer Beitrag: Die Jagd nach jedem einzelnen CVE ist sinnlos. Eine bessere Lösung ist ein Schwachstellenmanagementsystem aufzubauen, das sich auf Hardened Images, Build-Provenienz, und Richtlinien für die Behebung von Schwachstellen stützt. javapro.io/de/wie-man-c...

Season 6 of the @foojay.io #podcast kicks off with the launch of Java 27! @speakjava.bsky.social tells us what's new in this release and what is already known about what's coming in Java 28 from Project Valhalla. www.youtube.com/watch?v=k3aA...

Marketing software in the EU? You might have a new strict deadline to meet! One word: CRA. Actually, three. Cyber Resilience Act. Its Article 14 comes into effect today. What are the new rules, who is concerned, and what needs to be done TODAY: youtu.be/IQkzg7quc58

🔖Rebuild or Rebase? What to Do When a Container Image Changes A CVE patch for your base lands - do you need to rebuild the whole image for that? Not necessarily. Me and Dmitry put our heads together and created a guide on efficient image updates: bell-sw.com/blog/rebuild...

Livestream alert! This Friday, I am joined by my fabulous friend @dashaun.com on CyberJAR to discuss how buildpacks promote best security practices and how you can build on that momentum with BellSoft's Hardened Builder for Paketo buildpacks youtube.com/live/3ElGTo5...

👾New on CyberJAR: Implementing Zero Trust in CI/CD Follow a journey of an open source dependency to prod through five security gates, with 3 questions at each: what can go wrong, what evidence do we require, and should it be allowed to continue? www.youtube.com/watch?v=5CzD...

Liberica JDK CSPU builds are out! CSPUs follow the new accelerated cadence of JDK updates. They are released in-between standard quarterly updates and contain patches for known CVEs and other important security fixes. Update your JDK and stay safe❤️ bell-sw.com/blog/liberic...

Did you know? Spring Boot 4.1 brings Spring Data 4.1's type-safe property paths enabling devs to use method references instead of strings in data access code: Sort.by("lastname") ➡️ Sort.by(Person::getLastName)

👾New on CyberJAR: Applying Zero Trust to Open Source 10K GitHub stars, zero known CVEs. If these are the only controls you have for OSS, you're inviting trouble. Here's what trust in dependencies SHOULD look like: www.youtube.com/watch?v=Z5jJ...

Did you know? No need to always rebuild a container image when the base changes. We can rebase it: replace the runtime base and keep the upper layers unchanged. Buildpacks make it a first-class operation with pack rebase. BuildKit can do smth similar with COPY --link and a cache.

👾New on CyberJAR: What Are Hardened Images? Hardened images are the new black of container security. But what are they? How do they differ from slim or distroless images? How to choose a vendor? And what do teams win by migrating? Find the answers here: www.youtube.com/watch?v=YYw8...

👾New on CyberJAR: Should you use Alpine? What makes Alpine a beloved base for container images? Should you consider it for production workloads, or the trade-offs are not wirth the deal? Find out in my newest video: www.youtube.com/watch?v=37tn...

Buildpacks remove a lot of repetitive containerization work, but they also trade some control for automation. @edelveis.dev breaks down that trade-off in seven minutes, including where a Dockerfile still makes more sense: youtu.be/19ZDEvnjtDI

CyberJAR has been added to Foojay Java In Education Catalog! Thank you, @foojay.io and Igor Souza for recognition. This is an important milestone for CyberJAR, and I promise we will keep the momentum and deliver more content on all things Java☕️ education.foojay.social

Last week, @edelveis.dev and Mohammad-Ali A'râbi had a great conversation about Shai-Hulud, Miasma, Phantom Gyp worms - the latest wave of supply chain attacks. Missed the stream? The full recording is here: www.youtube.com/watch?v=SPly...

Dockerfiles are fine if they are written and maintained well. Then the base image gets old, the runtime needs a bump, and every repo has its own build ritual. @edelveis.dev gets into buildpacks: shared builders, rebasing, SBOMs, and when a Dockerfile still makes sense. bell-sw.com/blog/what-ar...

A smaller image is not automatically a hardened image. @edelveis.dev breaks down slim, distroless, scratch, and hardened images, then shows the Java adoption path: multi-stage builds, SBOMs, signatures, CI/CD checks, and a practical checklist. bell-sw.com/blog/what-ar...

On July 1 at 5 PM CEST, @edelveis.dev is hosting Johannes Bossle for Spec driven design on team level. Prompts work well right up to the point where a whole team has to build and maintain the same system. This session is about what comes next. Set a reminder: www.youtube.com/watch?v=6UqE...

Here is the new #JavaFX #LinksOfTheWeek on www.jfx-central.com/links. Thanks to Marius Hanl Oliver Kopp @ingstudios.dev Mechanical-pasta Marcus Hirt Michael Strauß Jonathan S. Fisher techsenger @frankdelporte.be @davidcalculin.bsky.social Happy reading, and have a lovely #Java weekend!

👾CyberJAR Livestream: Spec Driven Design on Team Level Scaling AI coding workflow across a team is hard. Join me an Johannes Bossle next Wednesday for a live demo on using visual specs, collaboration, and Git to give AI assistants the context teams need. www.youtube.com/watch?v=6UqE...

New JavaFX In Action 27 is live! 🎉 @davidcalculin.bsky.social built JMathAnim, a JavaFX library and UI for mathematical animations: LaTeX, fractals, geometrics, video export,... Built by a mathematician who "just needed the tool." 👉 webtechie.be/post/javafx-... #JavaFX #Java #OpenSource

Talk 3 of 3 at JRush Ep.7. 150 CVEs in the scan report. Most aren't exploitable in your runtime. @edelveis.dev covers this weekly on CyberJAR Youtube Channel. At JRush Ep.7 she builds the full triage-to-signed-image workflow live. Free. June 23. jrush.bell-sw.com/episode7 #Java #DevSecOps

👾New on CyberJAR: Java 27 Features The next JDK 27 release includes 9 JEPs with new or improved features. Let's look at all of them! www.youtube.com/watch?v=VxN-...

Picking a Java framework? @edelveis.dev compares Spring, Quarkus, Jooby, and Vert.x to help you decide which one fits your project best. foojay.io/today/spring... #Java #Framework

🎥 New video on the channel! You might be optimizing the wrong method. @edelveis.dev explains safepoint bias, how it can skew profiling results, and why Async Profiler has become a go-to tool for finding real Java performance bottlenecks. youtu.be/PcLZ6WPEcuw #Java #Async #OpenJDK #Profiling

First time at #JSpring @nljug.bsky.social 🇳🇱 Great talks, great conversations, and a warm welcome from the Java community. Thanks to everyone who joined @edelveis.dev and @asm0dey.site's session today ❤️ #JSpring #Java #DeveloperCommunity

Spring I/O 2026 Sessions Now Available Online-we did a bit of digging to suggest the best to watch first. On IProgrammer: dub.sh/d3LX6lS @springio.net @edelveis.dev

Our latest research found that 42% of Spring developers have never encountered hardened container images at all. That’s a major knowledge gap as supply chain security and CVE exposure become bigger concerns in production. So we made a quick guide: www.youtube.com/watch?v=Co16... #DevOps #Security

We had a great discussion with @mgrygles.bsky.social on the realities and prospects of event-driven systems powered by GenAI❤️‍🔥 The recording is available on YouTube: www.youtube.com/watch?v=WqT1...

🍃 The Persistence Heavyweight Championship: JPA vs. jOOQ by @asm0dey.site/ @edelveis.dev @ Spring I/O 2026 ▶️ Video: youtu.be/yAish_3P3-I 🔗 Slides: speakerdeck.com/cat_edelveis... #springio26

Live data. #GenAI. The part where your architecture has opinions about both. Join @edelveis.dev and #Java Champion Mary Grygleski on Thursday, May 21 at 6:30 PM CET. 🔔 Hit the bell. Don't miss it. youtube.com/live/WqT1dN5...

👾Upcoming Livestream: From Event Streams to AI Agents: Building Real-Time GenAI Systems This Thursday, I'm joined by @mgrygles.bsky.social to discuss how event streams, real-time data, and GenAI fit together in modern software architecture. www.youtube.com/watch?v=WqT1...

👾Previously on CyberJAR: 10 Cool Git Commands for Safer Workflows Moving past git commit: these commands will help you make smaller commits, move faster, and recover fast when things go sideways: www.youtube.com/watch?v=Q4M_...

CVE cleanup never really ends, and treating it like an endless patch queue gets old fast. In her piece for JavaPRO, @edelveis.dev writes about what scales better: hardened images, provenance, SBOMs, scanning, and patch workflows that hold up under constant pressure. javapro.io/2026/04/14/m...

Meet @edelveis.dev at #VaadinCreate 2026! Her session shows how to design Java container images based on real tradeoffs in startup time, memory, security, and scaling using @springboot + @vaadin. 📍 27–28 Oct | Barcelona 🎟️ Get your ticket: vaadin.com/vaadin-creat...