TJUG 1126 - Full AI Native JVM Dev: Requirements to Quality and Security

In the spooky month, we have two ghostbusters of the Java Ecosystem: Adam Bien (maybe the one who coined the zero-dependency idea in the Java ecosystem) and Steve Poole, who was promoting supply chain security practices even before most of you were born.

The event logistics and catering are provided by BMW Tech Works Romania.

17.30-18.00 Guest reception

18.00 - 18.45: From Ticket to Test: Use Case Driven Development, Revisited with Agents and Java (Adam Bien)

Because large language models are already well trained on Java code and platform specifications, writing code is no longer the hard part when the agent is guided by a few focused skills. The bottleneck now is expressing business intent precisely enough to get it right in one shot. This session revisits use case-driven development with coding agents. A ticket becomes a well-defined use case, the use case becomes a testable spec, and the agent implements the Java application until the spec-derived acceptance tests pass. Domain experts and analysts capture the intent and acceptance criteria, developers own the conventions, and the session shows what makes a use case complete enough for an agent to implement without clarification loops. Questions are welcome throughout.

18.45 - 19:30: You Don't Know What You Shipped: The State of the Modern Software Supply Chain (Steve Poole)

Software supply chain security is becoming increasingly difficult to manage. Cyber attacks are growing in scale and sophistication, AI is accelerating vulnerability discovery, and legislation such as the EU Cyber Resilience Act (CRA) is placing new obligations on organisations to understand, secure and maintain the software they ship.

At the same time, developers are becoming increasingly disconnected from the decisions about which components enter their applications. Dependencies are selected by frameworks, build tools and AI coding agents, often with limited consideration of their security, maintenance or support lifecycles.

In this session, we'll examine the state of the modern software supply chain and the pressures challenging traditional approaches to vulnerability management. We'll explore what happens when AI discovers vulnerabilities faster than maintainers can investigate and fix them, why end-of-life open-source components create particular problems, and how the systems we rely on to identify and manage vulnerabilities are struggling to keep up.

Through practical examples, we'll investigate what developers really know about the software they're shipping, where existing tools fall short, and how better dependency selection, software supply chain visibility and enforceable controls can help organisations manage the risks.

Shipping software with known vulnerabilities is a problem. Not knowing what you've shipped is becoming a much bigger one.

Building scalable Spring applications often depends on choosing the right approach to asynchronous programming. In the past, developers relied heavily on Reactive libraries and WebFlux to handle concurrency and scalability, but do those choices still make sense today? This session takes a practical look at how asynchronous programming in Spring Boot has evolved, comparing older reactive models with modern best practices. Attendees will explore current tools and design patterns for creating efficient, responsive Spring applications, and learn when (and when not) to use reactive approaches in today’s Spring ecosystem. The talk provides a clear guide to selecting the right async strategy for your workloads while keeping code maintainable and production-ready.

19:30 - 20.00: Panel - Unpopular Opinions on AI-Native Engineering (Adam Bien, Steve Poole, Alex Diniș)

> 20.00: Beer and chatter