Article

Think about the last PDF you “just quickly” edited online. A contract, a bank statement, a scanned ID, a tax form. You dragged it onto a website, the site did its thing, and you downloaded the result. That file — with your name, signature, and account numbers in it — passed through a server you don’t own, under a privacy policy you didn’t read, and you have no way to know whether it was deleted afterwards. ...

In the ThreadLocal leak post, ScopedValue was the third fix — two paragraphs and a filter snippet. This is the full treatment, because JDK 25 changed its status: after an incubator round in JDK 20 and previews in JDK 21–24, JEP 506 made java.lang.ScopedValue final in JDK 25. No preview flag. No incubator module. It is now part of the platform. First, the honest framing. “Replacement” comes with an asterisk: JEP 506 explicitly does not deprecate ThreadLocal, and migration is not a goal for every use. ScopedValue replaces the dominant request-context pattern: bind an immutable value at an entry point, let callees read it, and guarantee it disappears when that operation ends. It does not replace per-thread mutable caches, accumulators that callees update for a caller, or values that must outlive the method that created them. That distinction is the whole article. Get it right and ScopedValue removes a bug class. Treat it as a nicer global variable and you will recreate the ThreadLocal mess with newer syntax. ...

Vercel’s developer experience is genuinely excellent — push to Git, get a URL, previews for every pull request. The bill is the problem: per-seat pricing plus usage, and it scales with your success. Dokploy is the self-hosted answer that’s been eating that market: an open-source PaaS that gives you the same workflow — Git deploys, automatic HTTPS, preview environments, one-click databases — on a VPS you control, installed with a single command. Here’s the full setup, including the parts the highlight reels skip. ...

Google “Spring Boot JWT tutorial” and the top results still hand you the 2019 recipe: a custom OncePerRequestFilter that parses the Authorization header by hand, a third-party JWT library, a UserDetailsService, and five config classes of glue. It works — the way a hand-rolled ORM works. On Spring Boot 4, Spring Security 7 has first-class JWT support through the built-in OAuth2 Resource Server. No custom filter. No third-party JWT library. Here’s the modern shape, including what Security 7 removed out from under the old tutorials. ...

Every Spring codebase has its own API versioning story, and they’re all slightly embarrassing: /v1 and /v2 prefixes baked into paths, a custom header parsed by hand in an interceptor, or two parallel controller classes that drift out of sync. Spring Framework 7 — the foundation of Spring Boot 4 — finally makes versioning a first-class citizen: a version attribute on @RequestMapping and every shortcut variant, with the framework handling resolution, matching, and deprecation. Here’s how to use it, and where it bites. ...