Meetup with Steve Poole: AI, Software Supply Chains, and the Road to JDK 25

Join us for the next JUG.CY meetup featuring Steve Poole and two deep technical talks covering two major challenges facing modern software teams: securing AI-assisted development and modernizing production Java platforms.
AI is rapidly changing how developers write software, but the same tools that increase productivity can also introduce vulnerabilities, amplify insecure practices, and create new attack vectors across the software supply chain.
At the same time, many production systems still run on JDK 8 or 11. Moving them to JDK 21 or 25 is not simply a matter of changing the Java version and rebuilding the application. It means crossing a decade of platform evolution, including removed APIs, stronger encapsulation, JPMS, garbage collector changes, and new deployment and support considerations.
During this meetup, Steve will explore both sides of modern software engineering: how AI can become an attack vector inside your development process, and how to move a real Java platform forward without unnecessary risk, disruption, or cost.

Participation is completely free, but places are limited. Please check in if you plan to attend the meeting; we can't let you into the office if you are not on the list.

Agenda for this evening:

- Doors open at 18:30
- Talks will start at 19:00
- We will have a short break after the first talk
- We will have discussions regarding the talks with networking opportunities after.
- We will finish before 22:00 at the office, but nothing can stop us from continuing somewhere in the cozy bar.

Talks:

## The Enemy Within: How AI Is Weaponizing Your Code

AI-generated code has become a double-edged sword. It offers unprecedented productivity, while quietly introducing vulnerabilities and weaknesses into applications and development processes.
Whether the problem originates from poisoned models deliberately designed to produce insecure results, poor-quality training data, or untested AI-generated solutions, the assistant you trust may become a Trojan horse inside your codebase.
In this talk, Steve will examine the darker side of AI-assisted software development and explain how attackers can use AI to compromise open-source projects and infiltrate the software supply chain.
Using real-world examples, he will explore:

• how poisoned models and manipulated data can introduce security flaws;
• how attackers can embed vulnerabilities in libraries and projects developers trust;
• why seemingly correct AI-generated solutions may expose applications to serious exploits;
• how AI changes the threat model for open-source software and software supply chains;
• what development teams can do to review, test, and secure AI-assisted contributions.

In the battle for secure software, your development tools may become either your greatest weakness or your first line of defence.
This session will help you understand where the risks come from and how to use AI without surrendering control over the security of your code.

## Engineering a Modern Java Platform: JDK 8-to-25 Without the Pain

Most Java teams carry more technical debt than they realise.
Moving a large Java platform from JDK 8 or 11 to JDK 21 or 25 is not a routine dependency upgrade. It means navigating a decade of API removals, stronger encapsulation, JPMS changes, garbage collector evolution, and performance improvements that can reshape how applications are built, tested, and deployed.
This talk gives developers, architects, and platform engineers a practical view of what modernising a real Java estate involves: what tends to break, why it breaks, how to diagnose the problems, and how to establish a repeatable migration path without putting the platform or the budget at unnecessary risk.
The session will cover:

• using `jdeps`, `jdeprscan`, and JVM runtime flags to uncover hidden technical debt;
• identifying dependencies on removed or unsupported internal APIs;
• diagnosing reflection failures caused by stronger encapsulation;
• handling split packages and other JPMS-related problems in legacy applications;
• understanding how JPMS affects applications that were not originally designed as modules;
• structuring migrations into manageable and verifiable stages;
• evaluating the current Java support landscape;
• understanding why JDK 25 can serve as a stable long-term target.

This is not a theoretical overview of new Java features. It is a practical migration map for teams responsible for real production systems.
You will leave with a clearer understanding of the risks, the tools available to detect them, and the steps required to move a Java platform forward safely.