标签：#Java

At some point, a monolith starts working against you. In my case, Finovara was a single Spring Boot application handling everything (authentication, transactions, limits, piggy banks, notifications, activity logs, currency conversion) The bigger it got, the harder it was to change anything without worrying about something else breaking. So I broke it apart. This post is about the first three pieces I extracted: the API Gateway , the activity-log-backend , and a shared module called contracts-backend . The Old Structure Everything lived in one Spring Boot app. The activity log — which tracks everything a user does in the app (expenses added, limits changed, logins, account changes) — was tangled up with the core business logic. Adding a new type of activity meant touching the same codebase responsible for transactions, security, and everything else. The New Structure finovara-backend/ ├── api-gateway/ ├── activity-log-backend/ ├── contracts-backend/ └── core-backend/ Four modules (there will be more). Each with a clear responsibility. API Gateway The gateway is the single entry point for every request coming from the frontend. It runs on port 8888 with SSL enabled and uses Spring Cloud Gateway (WebFlux-based). Routing is simple and declarative: routes : - id : activity-log-backend uri : ${ACTIVITY_LOG_URL} predicates : - Path=/api/account-activity/**,/api/archive-activities/** - id : notification-backend uri : ${NOTIFICATION_BACKEND_URL} predicates : - Path=/api/notification-settings/** - id : core-backend uri : ${CORE_BACKEND_URL} predicates : - Path=/** Activity log routes go to activity-log-backend . Notification routes go to notification-backend . Everything else falls through to core-backend . The gateway also handles CORS centrally — https://localhost:5173 is the only allowed origin, with credentials support. No individual service needs to worry about CORS anymore. One thing worth noting: the gateway uses use-insecure-trust-manager: true for the HTTP client. Th

At some point, a monolith starts working against you. In my case, Finovara was a single Spring Boot application handling everything (authentication, transactions, limits, piggy banks, notifications, activity logs, currency conversion) The bigger it got, the harder it was to change anything without worrying about something else breaking. So I broke it apart. This post is about the first three pieces I extracted: the API Gateway , the activity-log-backend , and a shared module called contracts-backend . The Old Structure Everything lived in one Spring Boot app. The activity log — which tracks everything a user does in the app (expenses added, limits changed, logins, account changes) — was tangled up with the core business logic. Adding a new type of activity meant touching the same codebase responsible for transactions, security, and everything else. The New Structure finovara-backend/ ├── api-gateway/ ├── activity-log-backend/ ├── contracts-backend/ └── core-backend/ Four modules (there will be more). Each with a clear responsibility. API Gateway The gateway is the single entry point for every request coming from the frontend. It runs on port 8888 with SSL enabled and uses Spring Cloud Gateway (WebFlux-based). Routing is simple and declarative: routes : - id : activity-log-backend uri : ${ACTIVITY_LOG_URL} predicates : - Path=/api/account-activity/**,/api/archive-activities/** - id : notification-backend uri : ${NOTIFICATION_BACKEND_URL} predicates : - Path=/api/notification-settings/** - id : core-backend uri : ${CORE_BACKEND_URL} predicates : - Path=/** Activity log routes go to activity-log-backend . Notification routes go to notification-backend . Everything else falls through to core-backend . The gateway also handles CORS centrally — https://localhost:5173 is the only allowed origin, with credentials support. No individual service needs to worry about CORS anymore. One thing worth noting: the gateway uses use-insecure-trust-manager: true for the HTTP client. Th

Hey DEV community! 👋 I built IMGVO — a free image tool that works entirely in your browser. What it does Convert JPG, PNG, WebP, AVIF, HEIC and more Compress images up to 90% without quality loss Crop, resize, rotate, watermark Works offline (PWA) Why I built it Most image tools upload your files to servers. I wanted something private and instant. Tech 100% vanilla JavaScript No backend, no server Works offline as PWA Privacy first No files uploaded to any server. Everything runs locally in your browser. 🆓 Free, no signup required. 👉 Try it: https://imgvo.com Would love your feedback! 🙏

GitHub热门项目 | Free, open-source and self-hosted CAPTCHA alternative to reCAPTCHA. Privacy-first and powered by proof-of-work and instrumentation challenges. | Stars: 6,767 | 59 stars today | 语言: JavaScript

GitHub热门项目 | A full-stack AI helpdesk platform that uses machine learning, NLP, and OCR to automatically analyze support requests, detect similar incidents, and help teams resolve technical issues faster. | Stars: 139 | 4 stars today | 语言: JavaScript

GitHub热门项目 | use ai analysis Performance issue with perfetto | Stars: 491 | 1 star today | 语言: JavaScript

GitHub热门项目 | A bundler for javascript and friends. Packs many modules into a few bundled assets. Code Splitting allows for loading parts of the application on demand. Through "loaders", modules can be CommonJs, AMD, ES6 modules, CSS, Images, JSON, Coffeescript, LESS, ... and your custom stuff. | Stars: 65,757 | 2 stars today | 语言: JavaScript

JavaScript Data Types: Primitive and Non-Primitive Data Types Data types are an important concept in JavaScript because they define the kind of value a variable can store. Understanding data types helps developers write reliable and efficient code. What is a Data Type? A data type defines what kind of value a variable can hold. Example let name = " John " ; // String let age = 25 ; // Number let isActive = true ; // Boolean In the above example, each variable stores a different type of value. Types of Data Types in JavaScript JavaScript data types are broadly classified into two categories: Primitive Data Types Non-Primitive Data Types Primitive Data Types Primitive data types store a single and simple value. Characteristics Store a single value. Immutable (cannot be changed directly). Compared by value. Stored directly in memory. Types of Primitive Data Types 1. String Used to store textual data. let name = " John " ; 2. Number Used to store numeric values. let age = 25 ; let price = 99.99 ; 3. Boolean Represents either true or false . let isLoggedIn = true ; 4. Undefined A variable that has been declared but not assigned a value. let city ; console . log ( city ); // undefined 5. Null Represents the intentional absence of a value. let user = null ; 6. Symbol Used to create unique identifiers. let id = Symbol ( " id " ); 7. BigInt Used to store very large integers beyond the safe Number limit. let largeNumber = 123456789012345678901234567890 n ; Non-Primitive Data Types Non-primitive data types store multiple values or complex data structures. Characteristics Can store collections of data. Mutable (their contents can be modified). Compared by reference. Stored as references in memory. Types of Non-Primitive Data Types 1. Array Used to store multiple values in a single variable. let colors = [ " red " , " green " , " blue " ]; 2. Object Used to store data as key-value pairs. let person = { name : " John " , age : 25 }; 3. Function Functions are reusable blocks of co

Section 1: Getting Started with Cypress 1. Installing and Setting Up Cypress Prerequisites Before installing Cypress, ensure you have Node.js installed on your machine. Cypress requires Node.js 18.x or 20.x and above. You should also have an existing React project or create a new one. Check your Node.js version by running this command in your terminal: node --version # Should output v18.x.x or higher Creating a React Project (Optional) If you don't have an existing React project, create one using Vite which is the recommended approach for new React projects: npm create vite@latest my-react-app -- --template react cd my-react-app npm install Installing Cypress Navigate to your React project directory and install Cypress as a development dependency. Cypress is a fairly large package, so the installation might take a minute or two: npm install cypress --save-dev # Or using yarn yarn add cypress --dev Opening Cypress for the First Time After installation, open Cypress for the first time. This will create the initial folder structure and configuration files: npx cypress open When Cypress opens for the first time, you'll see a welcome screen where you can choose between E2E Testing and Component Testing. Select E2E Testing to get started with end-to-end tests. Cypress will then prompt you to choose a browser. You can select Chrome, Firefox, Edge, or Electron. Choose your preferred browser and click Start E2E Testing in [Browser] . Adding NPM Scripts Add convenient scripts to your package.json for running Cypress tests: { "scripts" : { "dev" : "vite" , "build" : "vite build" , "cy:open" : "cypress open" , "cy:run" : "cypress run" , "test:e2e" : "start-server-and-test dev http://localhost:5173 cy:run" } } Tip: Use npm run cy:open for interactive development with the Cypress Test Runner. Use npm run cy:run for headless execution in CI/CD pipelines. 2. Understanding Cypress Project Structure Project Directory Overview After initializing Cypress, you'll notice several new fold

Every week I see the same question in AI governance communities: "We already have NIST AI RMF implemented. Does that cover our EU AI Act obligations?" The honest answer is: sometimes yes, sometimes partially, and sometimes not at all. The problem is that nobody had built a clean, free, interactive tool that showed exactly which controls map to which, how strong those mappings actually are, and where the genuine gaps are. So I built one. Live tool: suhanasayyad.github.io GitHub: SuhanaSayyad / eu-ai-act-crosswalk-tool Interactive crosswalk mapping EU AI Act obligations to NIST AI RMF and ISO 42001 controls, with mapping strength indicators, gap analysis, and source links. 30 controls mapped. Free and open source. EU AI Act × NIST AI RMF × ISO 42001 - Interactive Compliance Crosswalk Tool An open-source tool that maps EU AI Act obligations to their equivalents in NIST AI RMF and ISO 42001, with mapping strength indicators, gap analysis, and source document links. Built for compliance teams, AI governance practitioners, and anyone trying to understand how these three frameworks relate to each other. Live demo: https://suhanasayyad.github.io/eu-ai-act-crosswalk-tool Built by: Suhana Sayyad | MSc Cybersecurity, TUS Athlone Why I built this Every organisation dealing with the EU AI Act is being asked the same questions: "We already have NIST AI RMF controls in place. Does that cover our EU AI Act obligations?" "We're pursuing ISO 42001 certification. Does that satisfy the regulation?" The honest answer is: sometimes yes, sometimes partially, and sometimes not at all. The problem is that nobody had built a clean, free, interactive tool that showed exactly which… View on GitHub What the tool does The EU AI Act / NIST AI RMF / ISO 42001 Interactive Crosswalk Tool maps 30 EU AI Act obligations to their nearest equivalents in NIST AI RMF and ISO 42001. For each mapping it shows a strength rating - Strong, Partial, Indirect, or No Equivalent - so compliance teams know which map

What I Built : ( https://github.com/Sai-Emani25/Solomon-s-Taskr ) I transformed my initial, bare-bones task management application, Taskr, into Solomon's Taskr—a significantly smarter, more robust productivity platform. The original project started as a standard way to log to-dos, but it lacked the intelligence to actually help manage time or prioritize effectively. With Solomon's Taskr, I wanted to build a system that doesn't just store data, but actively assists the user. Building this project means a lot to me because it represents a leap from writing basic applications to architecting intelligent, dynamic systems that solve real-world workflow bottlenecks. Demo Link to Final Repository: https://github.com/Sai-Emani25/Solomon-s-Taskr Link to Original Repository: https://github.com/Sai-Emani25/Taskr (Here is a quick walkthrough of Solomon's Taskr in action!) The Comeback Story The original Taskr project had been sitting in my repositories, unfinished and gathering dust. It was a classic case of starting a project with good intentions but abandoning it once the basic structure was complete. It could create, read, update, and delete tasks, but that was it. For the Finish-Up-A-Thon, I decided to completely resurrect and overhaul it. Here are the key changes and implementations that turned it into Solomon's Taskr: Complete Codebase Refactoring: I stripped down the old, inefficient logic and rebuilt the architecture to be highly scalable and maintainable. Intelligent Prioritization ("The Solomon Touch"): I integrated smart features to help organize and prioritize tasks rather than just listing them chronologically. (Note: If you integrated Gemini API or LLMs here for smart tagging, explicitly mention it!) Enhanced UI/UX: I moved away from the clunky, basic interface of the original Taskr and implemented a clean, responsive dashboard that provides a real-time overview of pending and completed tasks. Optimized Data Handling: I refined how the application processes and st

Why I stopped reading "❌ Old vs ✅ New" posts I used to scroll past them. Then I started ignoring them. Now? I don't read them at all. Not because they're "wrong". But because they're incomplete . The problem with "❌ Old vs ✅ New" These posts make everything look easy: One error One fix One clean "New Way" Three bullet points Save the post Done. Right? No. What these posts don't show you 🔹 The 200 failed deployments before that one working fix 🔹 The 300+ errors you solve along the way — not just one 🔹 The Vercel pipelines that break for no documented reason 🔹 The "New Way" that also fails in production 🔹 The gap between documentation and reality What happens in production That clean "New Way" code snippet? It might work on your local machine. But in production, with real traffic, real data, real edge cases? It can fail. Hard. And no three-line post prepares you for that. Why I stopped reading Because these posts teach me solutions to problems I don't have yet . But they don't teach me how to think when nothing works. They don't teach me: How to read error logs properly How to trace a pipeline failure across services How to stay consistent after multiple failed deploys How to know when the "New Way" is actually worse What actually helped me Not templates. Not shortcuts. Real experience: 200+ failed deployments 300+ errors solved (one by one) Broken pipelines fixed by understanding, not copy-paste Production live — not a "demo" or a "tutorial" This is not a "❌ vs ✅" post I'm not giving you a "Here's the fix". Because the real fix isn't three lines of code. It's patience. It's persistence. It's failing and getting back up. And no post can save that to your bookmarks. 👇 Have you ever followed a "New Way" post and had it fail in production?

Static Application Security Testing (SAST) is a critical practice in modern DevSecOps. While tools like SonarQube, Snyk, and Veracode are popular, this article focuses on GitHub CodeQL – a semantic code analysis engine that treats code as a database. We will apply it to a vulnerable Java Spring Boot application to detect SQL Injection and Path Traversal. 🤔 Why CodeQL? Unlike pattern-based scanners, CodeQL builds a relational database of your code, including abstract syntax trees, control flow graphs, and data flow graphs. This allows it to track tainted data across functions, classes, and files, drastically reducing false positives. 🚨 Target Application (Vulnerable Java App) Let's look at a simple REST API with two vulnerable endpoints. File: UserController.java package com.demo.controller ; import com.demo.model.User ; import org.springframework.beans.factory.annotation.Autowired ; import org.springframework.jdbc.core.JdbcTemplate ; import org.springframework.web.bind.annotation.* ; import java.nio.file.Files ; import java.nio.file.Paths ; import java.util.List ; @RestController @RequestMapping ( "/api" ) public class UserController { @Autowired private JdbcTemplate jdbcTemplate ; // Vulnerability 1: SQL Injection @GetMapping ( "/users" ) public List < User > getUsers ( @RequestParam ( "id" ) String userId ) { String sql = "SELECT * FROM users WHERE id = " + userId ; // Dangerous concatenation return jdbcTemplate . query ( sql , ( rs , rowNum ) -> new User ( rs . getString ( "id" ), rs . getString ( "name" ))); } // Vulnerability 2: Path Traversal @GetMapping ( "/file" ) public String readFile ( @RequestParam ( "filename" ) String filename ) throws Exception { return new String ( Files . readAllBytes ( Paths . get ( "/var/data/" + filename ))); } } 🛠️ Installing and Configuring CodeQL CLI You can run CodeQL locally to analyze your code before pushing it to a repository. 1. Download CodeQL from GitHub releases: wget [ https://github.com/github/codeql-cli-binaries/re

GitHub热门项目 | 🤖一个基于 WeChaty 结合 ChatGPT / Claude / Kimi / DeepSeek / Ollama等Ai服务实现的微信机器人 ，可以用来帮助你自动回复微信消息，或者社群分析/好友管理，检测僵尸粉等... | Stars: 10,760 | 128 stars this week | 语言: JavaScript

GitHub热门项目 | web development for the rest of us | Stars: 86,848 | 17 stars today | 语言: JavaScript

GitHub热门项目 | Digitalization of Judiciary System | Stars: 86 | 4 stars today | 语言: JavaScript

GitHub热门项目 | Community curated list of templates for the nuclei engine to find security vulnerabilities. | Stars: 12,471 | 9 stars today | 语言: JavaScript

GitHub热门项目 | Grab your own sweet-looking '.is-a.dev' subdomain. | Stars: 10,416 | 7 stars today | 语言: JavaScript

GitHub热门项目 | The Block Editor project for WordPress and beyond. Plugin is available from the official repository. | Stars: 11,682 | 3 stars today | 语言: JavaScript

GitHub热门项目 | AI-powered job search system built on Claude Code. 14 skill modes, Go dashboard, PDF generation, batch processing. | Stars: 48,805 | 197 stars today | 语言: JavaScript