<p><strong>TLDR:</strong> Kotlin 2.4.0 is out with stable context parameters, explicit backing fields, and Java 26 support on the JVM. A two-year-old Oracle WebLogic vulnerability is now confirmed actively exploited with over 1,500 servers still exposed online. Spring Boot 3.5 hits end of open-source support June 30, and the EU Cyber Resilience Act’s 24-hour reporting obligation kicks in September 11 — making that EOL date a compliance problem, not just a maintenance one. GraalVM 25 also landed with ML-based optimizations producing binaries averaging 17.59% smaller.</p>
<hr>
<h2>Kotlin 2.4.0 released with stable context parameters and Java 26 support</h2>
<p>Kotlin 2.4.0 promotes context parameters and explicit backing fields to stable, both of which have been in preview for several releases. The standard library gains a stable UUID API and sorted-order checking. On the JVM side, Java 26 is now supported and annotations in metadata are enabled by default. Tooling gets Gradle 9.5.0 compatibility and Maven automatic Java/JVM target alignment. The Kotlin Weekly also notes this is a K2-only release, and the migration guide from KAPT to KSP is worth reading if you’re still on AGP 9.2.1. <a href="https://app.daily.dev/feed-by-ids?id=MWoY7KsjV&amp;id=IOmbM51VJ&amp;id=WVtanbQkA&amp;id=MLm3DwXW3" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>CVE-2024-21182 in Oracle WebLogic now actively exploited, 1,592 servers exposed</h2>
<p>CISA added CVE-2024-21182 to its Known Exploited Vulnerabilities catalog this week. The flaw lets unauthenticated remote attackers read critical data via T3/IIOP on WebLogic 12.2.1.4.0 and 14.1.1.0.0 — Oracle patched it in July 2024, but Shodan shows over 1,500 vulnerable servers still reachable. Federal agencies had until June 4 to patch. If you’re running either affected version and haven’t applied the July 2024 CPU, that’s the immediate action item. <a href="https://app.daily.dev/feed-by-ids?id=Mr61eNezx&amp;id=dAETFeY5l" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Spring Boot 3.5 EOL June 30 collides with EU Cyber Resilience Act deadline</h2>
<p>Spring Boot 3.5 loses open-source support on June 30, 2026. That alone is a familiar migration pressure, but the EU CRA changes the calculus: from September 11, organizations face 24-hour reporting obligations for actively exploited vulnerabilities. After EOL, commercial support options like HeroDevs exist, which means ‘nothing we could do’ stops being a valid defense in a regulatory conversation. Migration from 3.5 to 4.0 involves 50-plus breaking changes and is estimated at 6-14 weeks depending on codebase size — if you haven’t started scoping that work, now is the time. <a href="https://app.daily.dev/posts/KVbVGSVe9" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>GraalVM 25 ships ML-based optimizations and 17.59% average binary size reduction</h2>
<p>GraalVM 25 introduces GNN models for -O2/-O3 optimization and GraalCC for binary size reduction, averaging 17.59% smaller binaries. SkipFlow is now enabled by default, contributing roughly 6.35% of that reduction. Security gets embedded SBOMs by default, advanced obfuscation, and PIE with relative code pointers. The new -H:Preserve option is aimed at simplifying migration for teams moving existing apps to native image. Upcoming work includes Project Crema for open-world native image and Native Image Layers. <a href="https://app.daily.dev/feed-by-ids?id=u9vbQ23ne&amp;id=wW5PTXAp9" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>jqwik 1.10.0 prompt injection follow-up: 1.10.1 still contains non-destructive payload:</strong> Version 1.10.1 softened the original delete-all-tests instruction but still ships a non-destructive prompt injection — teams running AI agents against codebases with jqwik should stay off the 1.10.x line and enforce sandboxed file-system access for agents. <a href="https://app.daily.dev/posts/Pu1IQp4hy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Micronaut 5.0.2 patches multiple CVEs via Netty 4.2.15:</strong> Micronaut Framework 5.0.2 bundles Netty 4.2.15, which patches multiple CVEs, making this a security-driven upgrade rather than a routine maintenance release. <a href="https://app.daily.dev/posts/qYFg22wRN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Tiberius: JUnit 5 library for LLM security testing with 200+ probes across OWASP LLM Top 10:</strong> Tiberius is an open-source Java library that integrates with JUnit 5 and Spring Boot to run probabilistic security contracts and fixture-based regression tests against LLM applications, shipping with 200-plus probes mapped to the OWASP LLM Top 10. <a href="https://app.daily.dev/posts/VKe1BkzAD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub Copilot Modernization reports 60-88% effort reduction for Java Struts-to-Spring Boot migrations:</strong> Microsoft’s generally available Copilot Modernization agent CLI runs parallel portfolio assessments and supports custom migration rules, with customers reporting 60-88% reductions in migration effort for Java Struts-to-Spring Boot and COBOL-to-Java workloads. <a href="https://app.daily.dev/posts/DJS2JuWnT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>IntelliJ IDEA 2025.3.6 ships Oracle critical patch update for Java 21:</strong> IntelliJ IDEA 2025.3.6 incorporates the latest Oracle critical patch update for Java 21 along with corresponding JetBrains Runtime changes, making it a security-relevant update for teams on the 2025.3 release train. <a href="https://app.daily.dev/posts/9vE9nd4uN" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Spring Boot, JVM updates, and Java ecosystem news.

Java Digest

Kotlin 2.4.0 is released with stable context parameters, explicit backing fields, UUID API, and Java 26 support, plus a migration guide from KAPT to KSP. CVE-2024-21182 in Oracle WebLogic is now actively exploited with over 1,500 servers still exposed — patching the July 2024 CPU is the immediate action. Spring Boot 3.5 hits EOL on June 30, 2026, which intersects with the EU Cyber Resilience Act's 24-hour vulnerability reporting obligation starting September 11, making migration to 4.0 a compliance concern. GraalVM 25 ships ML-based optimizations averaging 17.59% smaller native binaries via GNN models and SkipFlow. Notable items include a jqwik 1.10.x prompt injection issue, Micronaut 5.0.2 security patches, a JUnit 5 LLM security testing library, and GitHub Copilot Modernization reporting 60-88% effort reduction for Java migration workloads.

Kotlin 2.4 ships stable context parameters, WebLogic CVE-2024-21182 under active attack