reactor-core VS Spotbugs

I was exploring reactive streams with project reactor and I encountered a use case where I needed to skip to the next event if an error occurred during the processing of the current event (e.g. deserialization issue).

Kotlin also has a construct for asynchronous collections/streams. Kotlin's version of AsyncSequence is called a Flow. Just as Swift's AsyncSequence builds upon prior experience with RxSwift and Combine, Kotlin's Flow APIs build upon earlier stream/collection APIs in the JVM ecosystem: Java's RxJava, Java8 Streams, Project Reactor, and Scala's Akka.

Java's projectreactor.io ? It is widely used in Java world, see Spring WebFlux.

I guess more a closer comparison would be with the Project Reactor https://projectreactor.io/ which is also a low level framework for data processing.

Spring Framework is one of the most popular choices for web applications. It comes with a great ecosystem, tooling, and support. Spring applications are mainly written in Java. While they can serve quite well in many different domains and use cases, they may not be a good fit for modern-day applications which require low-latency and high-throughput. This is where the reactive programming paradigm could help because the paradigm is designed to address these issues by its non-blocking nature. Spring already supports reactive programming via Project Reactor.

The reactive streams API provides the specification for non-blocking async streams processing with back pressure mechanism, and Project Reactor is an implementation written in java.

https://projectreactor.io/ https://docs.oracle.com/javase/8/docs/api/java/util/stream/Stream.html https://rxjs.dev/ https://developer.android.com/kotlin/coroutines https://developer.apple.com/documentation/combine

With respect to Loom, it could be much easier for synchronous and reactive code to interoperate using schedulers that take advantage of Loom. The impact of Loom on Project Reactor was discussed in #3084, you might find it interesting.

SpotBugs is a great tool for static code analysis. Recently I got two similar warnings in one of the codebases I work on and I had to fix it.

SpotBugs is pretty good.

PMD, Spotbugs, Nullaway: Java linting/static analysis (https://pmd.github.io, https://spotbugs.github.io, https://github.com/uber/NullAway)

While at it you could also point them to static code analyzers such as error_prone, spotbugs and pmd (use all 3 at once - they complement each other in detecting different issues).

First, it's better to use SpotBugs 4.4.1 and above, that includes a fix to make SARIF report compatible with Github code scanning API requirements.

RUN wget https://github.com/spotbugs/spotbugs/releases/download/4.4.1/spotbugs-4.4.1.tgz

If you don’t have checkmarx/Vera code money, have you looked at https://find-sec-bugs.github.io/? It can be used with a few things such as https://spotbugs.github.io/ and sonarQ