HotSpot Strikes Back: Is JEP 544 The End Of The GraalVM Startup Monopoly?
Exciting times for the HotSpot JVM: JEP 544: Ahead-of-Time Code Compilation was just proposed for Java 28. This promises to give the HotSpot AOT cache a startup performance that will rival GraalVM, without any of its hardships. But training the AOT cache is different from pre-compilation with GraalVM, so how do they really compare?SBOMs Become Mandatory in 15 Months. Yours Is Probably Wrong.
On December 11, 2027, the SBOM obligations of the EU Cyber Resilience Act start applying. This means that you will soon need an SBOM if you want to ship software in the EU. It's not just the EU, but a global trend of enforcing supply-chain security with this declarative approach: The US has required SBOMs for federal software vendors since 2021, and CISA/NSA/FBI published updated SBOM minimum elements in July of this year.
Getting an SBOM correct is not easy, and it becomes even harder when you ship installers for your software. What should you do now? Let's take a look.
Introducing jvmguard: Automatic Production Profiling
There is a new open source tool from the team behind JProfiler: jvmguard helps your company to profile JVMs in production.
Profiling in production is risky, but often it is the only way to understand a problem. With jvmguard, profiling captures are authorized and audited, and can be started by a human, by an automatic trigger, or by an AI agent.
jvmguard works with JProfiler, but it is not limited to that integration. It also records JFR snapshots, HPROF heap dumps, and thread dumps and you can analyze them with other tools. The basic idea in jvmguard is that lightweight signals are always on, while deep captures only happen under certain conditions.
Website refresh: Visual updates, dark mode, and semantic search for docs
We have just rolled out significant changes to our website. They include many visual updates and important infrastructure updates that speed up loading times in many locations across the globe.
In addition, there are three functional changes that we would like to highlight:
All our artifacts are now published on Maven Central
We have migrated all of our public Maven artifacts to Maven Central. Previously, these artifacts were available from our own Maven repository, which will remain online for older releases. New releases will be published exclusively on Maven Central.
Why JVMTI sampling is better than async sampling on modern JVMs
In recent years, "async sampling" has been hyped as a better way of CPU profiling on the JVM. While this has been true for some time, it is no longer the case. This blog post explains the history of sampling and the current state of the art.
How invokedynamic makes lambdas fast
Recently, we have been at work rewriting our website in Kotlin. Instead of a view technology that uses string templates with embedded logic, we now use the Kotlin HTML builder to develop views as pure Kotlin code. This has a number of advantages, like being able to easily refactor common code. Also, the performance of such views is much better than that of string templates, which contain interpreted code snippets.
When measuring the performance, we noticed that a lot of anonymous classes were created for our views and their loading
time was significant. Code that uses the Kotlin HTML builder is very lambda-heavy and as of Kotlin 1.9, lambdas are
implemented as anonymous classes. The JVM has a sophisticated mechanism to avoid creating classes at compile time that
was introduced in Java 8 - the LambdaMetafactory
and invokedynamic.
The JVM developers also claimed that the performance would be better than anonymous classes. So why does Kotlin not use
that?
Improved Kubernetes authentication handling in JProfiler
Since version 13, JProfiler supports profiling on Kubernetes clusters with no extra configuration.
JProfiler 13.0.6 added an important improvement for profiling a JVM in Kubernetes clusters where authentication is set up in such a way that the authentication plugin prints instructions on stdout.
New web license service and improvements for the on-premises server
Customers with floating licenses now have more flexibility: Starting with with the most recent releases of JProfiler and install4j, we now offer a web license service, so you do not have to install a license server yourself. If you choose that option, you will receive a license key that can be distributed to all developers and is entered just like a single license key. This option requires the ability to make an outgoing HTTP request to our license server.
Going forward, we will be offering both the web as well as the the on-premises solution. For the time being, the on-premises option remains the default and you can contact us if you would like to switch to the web option.
Support for macOS Apple Silicon
Please note: Several JDK providers now offer the macos-aarch64 architecture and there is no need anymore to create the bundle yourself, install4j can do this for you automatically.
(Edited on 2021-01-07 to include changes for install4j 8.0.10)
Apple machines with the new ARM architecture are now available. While you can run existing x64 binaries for on ARM machines through Rosetta, the performance may be impacted significantly. install4j 8.0.9 addresses this concern with support for native ARM binaries.