Spotbugs VS Quarkus

SpotBugs is a great tool for static code analysis. Recently I got two similar warnings in one of the codebases I work on and I had to fix it.

SpotBugs is pretty good.

PMD, Spotbugs, Nullaway: Java linting/static analysis (https://pmd.github.io, https://spotbugs.github.io, https://github.com/uber/NullAway)

While at it you could also point them to static code analyzers such as error_prone, spotbugs and pmd (use all 3 at once - they complement each other in detecting different issues).

First, it's better to use SpotBugs 4.4.1 and above, that includes a fix to make SARIF report compatible with Github code scanning API requirements.

RUN wget https://github.com/spotbugs/spotbugs/releases/download/4.4.1/spotbugs-4.4.1.tgz

If you don’t have checkmarx/Vera code money, have you looked at https://find-sec-bugs.github.io/? It can be used with a few things such as https://spotbugs.github.io/ and sonarQ

Meanwhile, if you're building something smaller than Netflix, I'm writing a book just for that (https://opinionatedlaunch.com/).

It's about mobile apps, but I talk about backend at great length, especially since my background is Java. The book is called "opinionated" because I cover Quarkus (https://quarkus.io/), monolith, Fly.io, and no K8s.

Quarkus is a Java based framework tailored for GraalVM and HotSpot, which results in an amazingly fast boot time while having an incredibly low memory footprint. It offers near instant scale up and high density memory utilization which can be very useful for container orchestration platforms like Kubernetes or Serverless runtimes like AWS Lambda.

Other useful articles related to Quarkus extension development can be found under the Writing Extensions guide category on the Quarkus.io website.

Quarkus is one of Java frameworks for microservices development and cloud-native deployment. It is developed as container-first stack and working with GraalVM and HotSpot virtual machines (VM).

If you GraalVM Native Image or one of the frameworks based on it then bootstrap cost disappears:

https://quarkus.io

We are open to practice using any open-source project, however, we want to set a sharp focus on projects maintained by the Red Hat, and our own projects in the Caravana Cloud organization on github. If there is no reason to do differently, we'll build using technologies such as OpenShift, Quarkus, Ansible and related projects.

The Quarkus you are talking about is this one? https://quarkus.io/