Spring VS graalvm-reachability-metadata

This interface is a simplified version of real caching abstractions from Java technologies such as the ones from Spring or JCache (JSR-107). Both are part of quite complex solutions, having more generic types and different capabilities. Also, annotations would be preferred to using Cache directly in most Java applications.

Cross-post: Controller code using Unconfined Dispatcher #32032

Mitre really lost a lot of respect with CVE-2016-1000027. Every few weeks a warning that any SpringBoot 2.x project has a CVSS 9.8, which causes all sorts of heartache for those of us bound to CVE remediation. Every blasted security tool reports this one. Spring reviewed and rejected, as did our very, very large organization. Comically, this has become the CVE we use to see how our tools allow us to white/black list entries.

Thank god Spring dropped this interface in the Framework 6.x / Boot 3.x release, and the end for non-commercial support is this year for the old stuff.

https://github.com/spring-projects/spring-framework/issues/2...

Referring to https://github.com/spring-projects/spring-framework/blob/main/spring-web/src/main/java/org/springframework/web/bind/annotation/GetMapping.java, the value could have got assigned to any of the other members like name, path, params, etc. Is there any logic involved that enables the single value passed to the GetMapping annotation to be assigned to the value member?

This one. In short, JMS listeners stopped working randomly (of course only on Saturdays, and only under load), but at first we didn't know that and suspected the message broker at fault. We had quite extensive logging, but no observability on the broker. Can't remember all the details, but eventually we figured out it was the listener container, and I could reproduce it after debugging deeply into Spring code during a load test.

GitHub Stars: 51 K GitHub Link: https://github.com/spring-projects/spring-framework

It still has, but it is more of "imaginary" one (https://github.com/spring-projects/spring-framework/issues/24434).

Simple: Spring WebFlux does not require Servlet, but can adapt to it. We essentially built our own reactive HTTP abstraction, without any Servlet dependencies. Then we made adapters that use said abstraction for (Reactor) Netty and Servlet. Note that we have specific adapters for Tomcat, Jetty, and Undertow, relying on non-blocking native APIs.

gcj had a lot of problems beyond needing configuration of reflection metadata. It used a full reimplementation of the standard library, and it was never adopted by the wider Java community being largely just Red Hat's strategy for creating a fully open source Java implementation rather than something offering specific benefits to Java developers. In particular people thought it'd lead to faster code, but GCC was never designed for Java and the results were actually a fair bit slower iirc.

Native image is quite different. With this new release the compiled images can not only be faster than JIT compiled Java (wow) but also use way less memory and start instantly. At a stroke this is resolving one of the biggest complaints people have always had against JVM languages.

And as a consequence you're seeing adoption by the wider community. All the modern Java web frameworks support it now, and there's a metadata repository where it's collected for projects that haven't accepted it upstream yet [1].

[1] https://github.com/oracle/graalvm-reachability-metadata

Yeah, I was able to get it working by adding some custom runtime hints. jOOQ support was recently added to the graalvm-reachability-metadata repo via this issue, so that may make things easier

During native image generation, native-image tool does a static analysis. There are classes which might not get accessed during this static analysis and they get left out in the final artifact. To overcome this some extra information can be provided during build time. Creating this extra metadata is cumbersome. There's an effort to consolidate these metadata information for various 3rd party libraries into a shared github repo https://github.com/oracle/graalvm-reachability-metadata .

GraalVM is truly great stuff.

GraalVM native compilation helps Java in the data center to avoid being a cost sink and to reduce start-up latency. Oracle needs Java to sell enterprise software.

Oracle contributing to OpenJDK may be required for Amazon cooperation (since Amazon is pushing its own JDK build) and probably helps the library ecosystem work towards native compatibility.

Native support for reflection (used in many libraries) requires "reachability metadata), maps of reflective API usage, at build time. Anyone can do it, but enterprise requires authoritative sources. Until authoritative reachability metadata covers the transitive graph of library+version dependencies in enterprise software, GraalVM builds are a PITA.

- https://github.com/oracle/graalvm-reachability-metadata

- latest release: https://medium.com/graalvm/graalvm-22-3-is-here-jdk-19-build...

- graalvm "community" roadmap: https://github.com/orgs/oracle/projects/6

(As a side note: Mark Reinhold has run the JDK team since 1997: is there any comparable example of such stellar leadership for broadly-adopted software across multiple technical and organizational eras?)

Also, reflection is supported in AOT mode. The analysis, however, does require reachability metadata in some cases. In the best case, libraries provide and maintain appropriate configuration for this. Reachability metadata can also be shared via https://github.com/oracle/graalvm-reachability-metadata.

Most JVM libraries will require some amount of reflection for all frameworks as well, and for that we have made the bet to invest on a JVM wide effort -> https://github.com/oracle/graalvm-reachability-metadata.

The first issue should be solvable by refining Kotlin hints in https://github.com/oracle/graalvm-reachability-metadata that is used for non Spring hints with Boot 3.