Jonas Geiregat’s Post

Today I learned that from Java 23+ all annotation processors have been explicitly disabled by default. Before Java 23 the full classpath was scanned for any processors and those were automatically picked up. An attacker could exploit this by slipping a malicious processor into one of the many dependencies in your project. Otherwise known as a supply chain attack. That is why Bob stopped working according to some of my colleagues who switched from Java 21 to 25. Turned out it wasn't Bob after all. As such I updated Bobs documentation on how to explicitly set the annotation processor so you can happily generate your builders! https://lnkd.in/eQjD7hcq #java

To view or add a comment, sign in

Explore content categories