InfoQ - Development

Java News Roundup: JobRunr 9, OpenXava 8, Quarkus, LangChain4j, JNoSQL, Introducing Lathe

Michael Redlich — Mon, 05 Oct 2026 17:00:00 GMT

This week's Java roundup for September 28th, 2026, features news highlighting: the GA releases of JobRunr 9.0 and OpenXava 8.0; point releases for Quarkus, Micronaut, LangChain4j, Eclipse JNoSQL; ADK for Java and ADK for Kotlin; and introducing Lathe, a new Java language server.

By Michael Redlich

Akka Tests Spec-Driven AI Delivery Across 65 Open Source Projects

Leela Kumili — Mon, 05 Oct 2026 13:58:00 GMT

Akka used 65 open-source projects to examine how specification structure, context, model selection, automated validation, and delivery guardrails affect AI assisted software porting. The experiment measured time, token use, code size, test parity, and performance, finding substantial variation across models, effort levels, and project types.

By Leela Kumili

Presentation: Building Reusable Evaluation Frameworks for Agentic AI Products

Susan Chang — Mon, 05 Oct 2026 11:19:00 GMT

Susan Chang explains how Elastic transitioned from siloed, ad-hoc AI agent evaluations to a unified, production-grade framework. She discusses balancing LLM-as-a-judge with deterministic rules, bridging Python data science evals with TypeScript production code, and implementing deep tracing to catch regressions across complex RAG and cybersecurity workloads while preserving domain context.

By Susan Chang

Aspire 13.6 Adds Persistent Dashboard Telemetry and First-Party Java and Rust Hosting

Almir Vuk — Mon, 05 Oct 2026 09:39:00 GMT

Microsoft has released Aspire 13.6. The dashboard now stores telemetry in SQLite and keeps up to ten completed runs per application. The release adds prerelease hosting packages for Java and Rust, portable volume paths, and new CLI options. Breaking changes include automatic TLS for local MongoDB resources and a new default Cosmos DB emulator image.

By Almir Vuk

Cloudflare Fixes Cross-Tenant Data Exposure in Containers

Steef-Jan Wiggers — Mon, 05 Oct 2026 08:48:00 GMT

Cloudflare has disclosed a cross-tenant data exposure vulnerability in Containers and Sandboxes, caused by thin-provisioned storage pools configured to skip zeroing reused blocks. Researchers recovered directory structures, database pages and complete SQLite databases across four continents. Cloudflare remediated it and found no evidence of exploitation.

By Steef-Jan Wiggers

Cloudflare Plans Public Certificate Authority to Issue Quantum-Safe TLS Certificates

Olimpiu Pop — Mon, 05 Oct 2026 05:05:00 GMT

Cloudflare will operate a free public Certificate Authority to issue quantum-safe Transport Layer Security certificates. This initiative addresses challenges in migrating from classical public key cryptography to post-quantum methods. It utilizes Merkle Tree Certificates to reduce data payloads and maintain system efficiency, while also enhancing certificate transparency and revocation processes.

By Olimpiu Pop

Google's Android Security State Libraries Enable Component-Level Security Verification

Sergio De Simone — Sun, 04 Oct 2026 17:00:00 GMT

Google's AndroidX Security State libraries enables apps to verify security patch status at the individual component level, rather than relying on a single, device-wide security patch date.

By Sergio De Simone

Pizza Bot: Open-Source Inbox for Background AI Agents

Renato Losio — Sun, 04 Oct 2026 06:34:00 GMT

A team of developers working at AWS recently open-sourced Pizza Bot, a self-hosted application designed to let AI agents run tasks in the background and return results through an inbox-style interface. Agents can perform scheduled or webhook-triggered work, delegate tasks to specialized workers, and pause for human approval when needed.

By Renato Losio

New Archestra's OpenAPPA Saturates Two Major Security Benchmarks with a 0% Attack Success Rate

Bruno Couriol — Sat, 03 Oct 2026 23:41:00 GMT

Archestra released OpenAPPA, an open-source security engine designed to stop data exfiltration caused by prompt injection or model hallucination. The team reports zero successful attacks when running security benchmarks Bench-Corp (20 multi-step enterprise workflows) and AgentThreatBench, versus 10% for Claude Code’s auto mode and 31% for Microsoft FIDES.

By Bruno Couriol

GitLab Vulnerability under Active Exploitation Enables Unauthenticated Data Exfiltration

Sergio De Simone — Sat, 03 Oct 2026 16:00:00 GMT

CVE-2026-85706 is a critical GitLab path-traversal vulnerability that has moved beyond theoretical risk into confirmed exploitation. It affects self-managed GitLab CE/EE and could allow an unauthenticated remote attacker to read arbitrary files from the GitLab.

By Sergio De Simone

Presentation: Building GenAI Platform at DoorDash

Siddharth Kodwani, Swaroop Chitlur — Sat, 03 Oct 2026 11:00:00 GMT

Swaroop Chitlur and Sidd Kodwani share DoorDash’s journey building an internal GenAI platform. They discuss core architectural bets, transitioning from vendor-first setups to open-weights models, navigating LLM and agent gateways, and balancing accuracy, latency, and cost for over 5,000 internal users.

By Siddharth Kodwani, Swaroop Chitlur

Istio 1.31 Adds Agentgateway Waypoints and Moves Release Artifacts off Google Cloud

Mark Silvester — Sat, 03 Oct 2026 08:30:00 GMT

Istio 1.31 adds agentgateway waypoints in ambient mode, with a canary configuration fix included in 1.31.1. It also ends the publication of images and Helm charts to Google Cloud, requiring repository migration ahead of the 13 October outage test and signing-key updates for teams verifying images.

By Mark Silvester

AI Agents Are Disrupting Open Source Security Disclosure

Renato Losio — Sat, 03 Oct 2026 06:46:00 GMT

A recent article by Anil Madhavapeddy argues that AI agents can turn publicly available clues about software vulnerabilities into working exploits, reducing the effectiveness of traditional disclosure embargoes in open source projects. The author highlights the need for faster patching and release processes as the time between vulnerability disclosure and exploitation shrinks.

By Renato Losio

Uber Eats Rebuilds Search Pipeline to Cut End-to-End Latency by 50%

Leela Kumili — Fri, 02 Oct 2026 14:22:00 GMT

Uber has rebuilt major parts of the Uber Eats search pipeline, reporting a 50% reduction in end-to-end latency. Changes include Above-the-Fold measurement, reduced retrieval work, parallel hydration, advertising data redesign, infrastructure optimizations, and an agentic coding workflow. Uber is also exploring microbatching, product-based retrieval, and HTTP multipart streaming.

By Leela Kumili

Presentation: Managing Asynchronous APIs at Scale

Ian Cooper — Fri, 02 Oct 2026 11:00:00 GMT

Ian Cooper discusses managing asynchronous APIs in event-driven architectures at scale. He explains the "ABCs" of messaging (Address, Binding, Contract) and shares how to tackle discovery, governance, and provisioning using AsyncAPI, CloudEvents, schema registries, and automated CI/CD infrastructure pipelines based on real-world engineering practices at Just Eat Takeaway.

By Ian Cooper